Skip to main content
Documentation
Documentation
Peakon
Last Updated: 2025-02-07
Setup Considerations: Integrations

Setup Considerations: Integrations

You can use this topic to help make decisions when planning your configuration and use of employee provisioning and integrations. It explains:
  • Why to set them up.
  • How it fits into the rest of Peakon.
  • Downstream impacts and cross-product interactions.
  • Security requirements and business process configurations.
  • Questions and limitations to consider before implementation.
Refer to detailed task instructions for full configuration details.

What They Are

Employee provisioning and integrations enable you to populate your Peakon employee directory and continuously update your employee records.

Business Benefits

  • Minimize effort and reduce complexity and human error through automated employee data import and management.
  • Improve efficiency and security by creating unique custom employee user identity attributes. Examples: Usernames, roles, and profiles.
  • Save time and effort by using predefined role access permissions.
  • Continuously update employee profiles to ensure that you have only the most up-to-date records.
  • Increase security by restricting access to employees when they leave your organization.
  • When you use a Peakon-provided, external REST API to build custom applications and integrations for employee provisioning, you can authenticate by sending an HTTP POST request to the
    /v1/auth/application
     endpoint.

Use Cases

Use the Workday-provided integration to exchange employee data between Peakon and Workday. The integration enables you to sync employees either by:
  • Criteria that your organization requires.
  • Supervisory organization.
Use Peakon provided integrations to these third-party service providers to create and sync your employee records to Peakon:
  • BambooHR
  • HiBob
  • Okta
  • Personio
Build custom applications and integrations for your employee provisioning using a Peakon-provided external REST API.
Use Simple Cloud Identity Management (SCIM 2.0) to integrate with external provisioning applications, such as Sapling and Namely.
Manage user credentials centrally through a third-party identity provider (IdP), such as Microsoft Azure Active Directory, to enable Single Sign-On (SSO) for users.

Questions to Consider

Questions
Considerations
How do you want to integrate your existing identity management process or Identity Provider (IdP) with Peakon?
When you use an existing IdP that supports the SCIM 2.0 protocol, you don't need a custom integration.Examples: Microsoft Azure Active Directory or Okta.
You can use the Peakon SCIM 2.0 API to automatically provision and update employee records.
You can configure the IdP for automatic provisioning to Peakon as a standard SCIM 2.0 service provider.
When you require a custom integration, use the SCIM URL and OAuth Bearer Token.
What attributes do you want to use to identify employees?
Peakon uses 2 unique identifiers for employees when you provision through third-party service providers:
  • Email address
  • Employee number
The Workday integration enables you to use unique external IDs to identify employees.
Use both unique identifier fields to help reduce human errors during data uploads.
You can also sync Personal Email addresses in order to survey exited employees.
Register your organization's email domains with Peakon before you enable employee provisioning.
Which Active Directory do you use?
User provisioning through SCIM 2.0 is only available through Azure Active Directory.
When you use an on-premise AD solution, configure the AD to sync its data to Azure Active Directory using Azure AD Connect.
When you configure Azure AD for provisioning, enable syncing of
Users
 and disable
Groups
.
How do you want to authenticate transferred data when you connect Peakon and Workday?
You can connect either through OAuth or by using an integration system user (ISU) name and password.
OAuth enables Workday users to authorize third-party clients to access their Workday data securely on their behalf.
We recommend only using OAuth if you use People Experience cards to notify employees of surveys.
Alternatively, you can also authenticate transferred data for cards using Alpaca.
When you select an authentication policy, consider:
  • Workday environments for which you’re creating the authentication policy.
  • Networks and IP addresses from which you want to block all users.
  • Networks and IP addresses for which you want to enable access to users.
  • Methods you want to require users to authenticate with, and if you want to require multifactor authentication for users.
  • Functionality to which you want to restrict users after they authenticate.
How do you want to authenticate your custom applications and integrations for employee provisioning?
In response to a successful authentication request:
  • A JSON web token returns.
  • All subsequent API requests contain an Authorization header bearing the encoded token.
In response to a successful authentication request, a JSON Web Token returns and all subsequent API requests contain an Authorization header bearing the encoded token.
Separating authentication and authorization tokens enables you to deploy the application where only an assigned application developer or a company admin can access the authentication token.
Workday assigns and shares authorization with application users.
What third-party service provider do you want to use to notify employees of surveys?
You can use Slack to notify employees of new surveys and send survey reminders.
Slack only notifies employees with Peakon email addresses that match their Slack email addresses.
Only Peakon administrators can add the Peakon app to Slack. Only the Slack administrator can add the Peakon app to your organization's Slack workspace.
Microsoft Teams enables you to send survey reminders and enables employees to complete their surveys in the Teams application.
Microsoft Teams only notify employees whose Peakon email address matches their Microsoft Teams email address.
How do you want to control access to all employee records?
Only your default administrator access group has access to integrations and employee provisioning.
For security reasons, Workday recommends that you keep the number of users with system-wide administration access to a minimum. You can set up a Human Resources and Senior Leaders access group with access to all employees.
How do you want to manage attribute hierarchies?
When you create attribute hierarchies that update automatically, automatic syncing of employee information can shift hierarchies during live survey rounds.
Hierarchy updates don't affect dashboard scores and participation. However, changes in the
Child Segments
 area of the heat map can display for administrators and segment managers.

Recommendations

  • Add these outbound IP addresses to your browser Allow List for SCIM API and for Workday integrations:
    • 176.34.69.237
    • 18.202.158.27
    • 34.253.249.186
    • 54.220.91.27

Requirements

  • Use 2 unique identifiers for each employee to ensure data accuracy when you transfer employee information between Peakon and third-party providers. Example: Employee email address and employee identification number.

Limitations

  • Peakon doesn't support SCIM groups and doesn't support groups as defined in Azure AD.
  • When you use the Workday to Peakon integration, indirect changes to employee information, such as a change of manager, don't transfer in the hourly sync. Workday recommends that you launch a full sync manually before each survey round.
  • When you use only 1 unique identifier for employees, automatic integrations can create a duplicate employee record when an employee changes the value of the unique identifier.
  • The
    Auto-load
     event logs feature only works for native HRIS integrations (Example: Workday, bob, BambooHR and Personio) and is not available for custom integrations.
  • For all HRIS integrations except Workday, it is not possible to disconnect, disable, or update sync configuration options while a sync is running. Administrators are notified when a sync has completed or automatically disconnected.

Tenant Setup

No impact.

Security

  • Administrator is the primary access control group in Peakon for integrations and employee provisioning.
  • The first user of the account automatically becomes the administrator. The administrator can manually add new administrators to the access control group as required.
  • Administrators have access to the entire company account and all employees, with all permissions, including integrations, turned on by default.
  • Administrators can also assign access for other administrators, managers, and employees.
Domains for the Workday-to-Peakon integration include:
Domains
Considerations
Integration Security
 in the Integration functional area.
Enables you to transfer employee data from Workday to Peakon automatically using an integration.
This domain provides access to create system users and Workday accounts for integration systems.
Security Configuration
 in the System functional area.
Provides access to security configuration including:
  • Business process security policies
  • Domain security policies
  • Functional areas
  • Security groups
It also includes reports to analyze and review the current security configuration.
These domains in the Integration functional area:
  • Integration Build
  • Integration Configure
Enables you to access the
Create Integration System
 task.
The
Integration Build
 domain provides access to setup information related to integration systems and integration IDs.
The
Integration Configure
 domain provides access to configure integration systems.
These domains in the System functional area:
  • Set Up: Tenant Setup - Security
  • Security Administration
Enables you to set up People Experience cards for the Workday integration.
Worker Data: Public Worker Reports
 in the Staffing functional area.
Secures access to the Workday
Get_Workers
 web service. Enables you to launch the Workday-to-Peakon integration. This domain requires unconstrained access for the ISU or user.
Worker Data: Workers
 in the Staffing functional area.
Enables you to retrieve constrained groups of employees when you launch the Workday-to-Peakon integration.
These domains in the Contact Information functional area:
  • Person Data: Date of Birth
  • Person Data: Ethnicity
  • Person Data: Gender
  • Person Data: Work Email
Enable access to personal employee data.
Manage: Location
 in the Organizations and Roles functional area.
Enables access to employee time zone and locale information.
These domains in the Staffing functional area:
  • Worker Data: Active and Terminated Workers
  • Worker Data: Business Title on Worker Profile
  • Worker Data: Current Staffing Information
Enables access to information on currently employed and terminated employees.
Job Information
 in the Jobs & Positions functional area.
Enables access to employee job profiles.

Reporting

In Peakon, you can generate integration audit logs for third-party integrations. The audit logs list integration events and any errors or failures in launched integration events.
In Workday, you can use these reports for the Workday to Peakon integration:
Reports
Considerations
View Security for Securable Item
Displays domains that secure web service tasks.
View Integration System
Displays details about the integration system.
Enables you to analyze an integration system and:
  • Launch or schedule an integration event.
  • Perform related actions to edit the configuration.
  • View or edit other settings depending on your security permissions.

Integrations

Integration
Consideration
Workday
The
Get_Workers
 web service enables you to retrieve employee data from Workday and detects and transmits changes to employee information.
You can capture information relating to all terminated workers, enabling you to sync information to Peakon when terminations occur on the same day as the integration.
The integration also removes all rescinded employee hires and contingent worker contracts from your Peakon employee records.
Personio
Requires a Personio client ID and client secret.
BambooHR
Peakon extracts employee data from BambooHR and maps it over to compatible fields on Peakon.
Workday recommends you apply the same BambooHR naming convention to your attributes on Peakon, using the standard fields for Peakon and BambooHR. Exact matching ensures that field values map correctly when you connect Peakon and Workday.
HiBob
Requires an API token from HiBob.
You can set up automatic synchronization using a webhook from HiBob, which you can enter using Settings on the HiBob integration page in Peakon.
Sapling
Sapling users can have multiple performance management integrations enabled. Sapling displays a Performance menu from which to select the app you want to open for the user.
Okta
Requires an OAuth bearer token from the Peakon integration settings page.
SCIM 2.0
You can set up integrations with external account provisioning applications and services using the Simple Cloud Identity Management (SCIM) format.
SAML 2.0
You can use Security Assertion Markup Language (SAML) for Single Sign-On (SSO) and single logout (SLO) in Peakon.

Connections and Touchpoints

Joint Workday and Peakon customers can use People Experience cards to send survey links directly to workers' Timely Suggestions in Workday.
Workday offers a Touchpoints Kit with resources to help you understand configuration relationships in your tenant. Learn more about the Workday Touchpoints Kit on Workday Community.