Configurable Security Framework

Overview

Objectives

Summarize the structure of configurable security and its implications.
Evaluate and modify configurable security on domains and business processes.
Activate security policy changes to create a new security evaluation moment.
Recognize the function and use of Workday-assigned, user-based, and role-based security groups.
Differentiate between constrained and unconstrained access.
Create security groups and test permissions.

Configurable Security Framework

Security Policies

Security groups gain access to domain and business process types in Workday via security policies. Add security groups to a domain security policy to grant access to the secured items within the domain. Add security groups to a business process security policy to grant ability to participate in (e.g., initiate, rescind, approve) that type of business process.

Illustrative example of the configurable security framework.

What Can Be Configured?

Enabling Functional Areas

Depending on the scope of your Workday deployment, not all functional areas will be enabled. For example, your deployment may occur in multiple phases. One of these phases could include deployment of the Advanced Compensation functional area. This would require you to enable the new functional area and any security policies for secured items you want to provide access to.

Use the

Maintain Functional Areas

task to enable or disable functional areas. This task displays the Workday-delivered functional areas and the domains and business process types in each. Select the checkbox under the Enabled column to enable or disable a functional area.

Report

: You can also use the

Functional Areas

report to access an overview of the Workday-delivered functional areas and the domains and business process types in each.

Security Groups

User-Based versus Role-Based

An administrator type security group.
Access is system-wide.
Assign directly to a worker.
Target access is always unconstrained.

A partner or leader type security group.
Access is specific to one or more organizations.
Assign directly to a job or position.
Can have either constrained or unconstrained target access.

User-Based Security Groups

HR Administrator
Payroll Administrator
Finance Administrator
Security Administrator
Report Writer
Auditor

Role-Based Security Groups

Create Role-Based Security Groups

Like user-based security groups, Workday delivers some starting role-based security groups. However, you may still need to create your own to fit your unique business needs. While you assign user-based security groups directly to a user, you assign role-based security groups to a job or position through assignable roles. If you need to create a custom role-based security group, there are steps that you need follow.

Run the
Maintain Assignable Roles
task and confirm the assignable role is there.
Run the
Create Security Group
task and select either Role-Based (Constrained) or Role-Based (Unconstrained) to meet your needs. Use the desired assignable role.
Assign workers' positions/jobs to the role for enabled organizations.
Important
: Maintaining role assignments is an ongoing process.
Edit security policies to include the security group for desired security permissions.
Run the
Activate Pending Security Policy Changes
task.
Test your configurations.

Maintain Assignable Roles

Define and enable assignable roles for the necessary organization types first, then you can create or work with a role-based security group.

View and Maintain Assignable Roles

Run the

View Assignable Roles

report to access assignable roles already configured in your tenant.

Use the

Maintain Assignable Roles

task to add, remove, and maintain assignable roles. The required fields are Role Name, Enabled For, and Assigned by Security Groups.

Maintain Assignable Roles

Note

: The Assigned By Security Groups field establishes the role maintainers, which are security groups whose members can approve assignments for this role. Role maintainers can assign members of the role only within the organizations they support.

The available fields in the

View Assignable Roles

and

Maintain Assignable Roles

tasks are:

Field	Definition
Role Name	This field allows you to provide a name for your assignable role. Common names include the terms "partner," "manager," or "analyst."
Workday Role (Optional)	There are certain Workday-provided roles, such as the Manager or Benefits Partner roles, that Workday uses for nonsecurity purposes, such as populating worklets or generating reports. Only the roles that appear in the prompt are available to map. Once you have mapped them, they no longer appear in the prompt list.
Enabled for	This field allows you to select the types of organizations for which you want to maintain and assign this role. Note : Configure a single role for a single organization type, when possible. Configuring a role for multiple organization types can make it difficult to determine how a user is able to access a particular secured item. The exception is for organization types where there is role inheritance between a hierarchy and its included organizations, such as cost center hierarchy and cost center.
Default Role	An unassigned role can inherit from a superior organization. This field allows you to select another role as the default assignment. Available default roles are other roles that are valid for the same organization type.
Self-Assign	Select this option to default the role assignment to the organization creator's primary position. If you select Yes for Self-Assign, you can also select the Restricted to 'Assign Self-Assign Roles' BP field.
Restricted to 'Assign Self-Assign Roles' BP	With this option selected, Workday automatically assigns the creator of an organization to fill the role for the organization they are creating.
Restricted to Single Assignment	This field allows you to restrict the role assignment to one position. Do not select this option for the Workday Manager role if you wish to allow the assignment of multiple managers to a supervisory organization.
Hide on View if Not Assigned	When viewing an organization, you can determine the roles enabled for that organization type and the assignments. With this option, you can choose to hide unassigned roles. If selected, noninherited unassigned roles will not display on the following reports: The Unassigned Roles Audit report The Support Roles report on Worker profile The View Roles report for Organizations There is no impact on the Unfilled Assigned Roles Audit report. Do not hide roles you need to audit, such as roles used in your business process routing.
Is Leader / Is Supporting	Select for roles whose assignees should display as leaders in the organization chart and organization preview. Workers assigned to an Is Leader role display in the supervisory or matrix organization name when you select Include Manager Name. These options also drive the delivered My Leadership Roles and My Support Roles reports.
Show inherited assignees for Security Groups	Displays all inherited role assignments for the selected security group when viewing the Support Roles page of the Worker Profile and the Roles tab of the organization.
Role Assignees Restricted to	This field allows you to restrict a given role to members of a defined security group. When assigning the role, only members of the security group specified will be available.
Assigned by Security Groups	This field allows you to specify all security groups whose members can approve role assignments for this role. Workday automatically assigns members of this designation to the Role Maintainer security group for the given role.
Assignable Role Usages	This Usage button displays: Any Workday roles defined for this assignable role. The total role assignment count. The total assignable role relationship count. The role-based security groups defined for the role.
Role-Based Security Groups	This field contains the number of role-based security groups associated with this role. You may select the number for a list of those security groups.

Security Note

: The Set Up: Assignable Roles security domain secures the

View Assignable Roles

and

Maintain Assignable Roles

tasks.

Create a Role-Based Security Group

Once you define assignable roles, you then configure the role-based security group to grant members (those users assigned to the role) access in Workday. You can create constrained or unconstrained role-based security groups. Constrained role-based security groups are most common because they limit members' target access to organizations supported in a role.

Assign Roles to Worker's Position or Job

To assign roles directly to a worker's position or job, navigate to their Related Actions, then select Security Profile, and choose one of the following actions:

Related Action	Definition
Assign Roles - Add/Remove	This option enables you to add roles, remove selected roles, remove all roles, and copy role assignments from another worker.
Assign Roles - Change Assignments	This option enables you to propose multiple roles for multiple assignees. The role assignment grid initially populates with the worker's primary position, and then you can propose changes.

These tasks provide:

Common actions such as add, remove, copy, and maintain roles.
Visibility into the role assignments of a worker.
The option to update later-dated assignments.

If the worker assigning the role is not in the Role Maintainer security group, the system routes an approval step for the role assignment to the Role Maintainer.

Note

: Configure security groups permitted to access these actions (and more) by editing the security policy permissions for the

Assign Roles

business process.

Here is an example of the

Assign Roles - Add/Remove

task:

The "Assign Roles - Add/Remove" task for Beth Liu.

Access Rights to Organizations

For constrained role-based security groups, there are four options for configuring access rights to organizations:

Access Rights	Definition
Current Organization Only (COO)	Constrains members to organizations where they have the role assignment.
Current Organization and Unassigned Subordinates (COUS)	Constrains members to organizations where they have the role assignment and subordinate organizations that do not have someone assigned to the role.
Current Organization and All Subordinates (COAS)	Constrains members to organizations and subordinate organizations, regardless of whether they have someone assigned to the role.
Current Organization and Subordinates to Level	Constrains members to organizations and subordinate organizations, down to a number of levels in the hierarchy.

Access Rights to Multiple Job Workers

There are three options for configuring access rights to workers who have multiple jobs:

Option	Description
Role has access to the positions they support	Grants access only for the job or position that you assign to the role in the specified organization. Example: Sarah has a primary position at Company 1 that Mark manages and a secondary position at Company 2 that Susan manages. When you select this option: Mark can access Sarah's person data and primary position data for Company 1. Susan can access Sarah's person data and secondary position data for Company 2.
Role for primary job has access to all positions	Grants access to assignees who have a role in the organization associated with the primary job or position. Denies access to assignees who have a role in the organization associated with an additional job or position. Example: Sarah has a primary position at Company 1 that Mark manages and a secondary position at Company 2 that Susan manages. When you select this option, only Mark can access Sarah's: Person data. Primary position data for Company 1. Secondary position data for Company 2.
Role has access to all positions	Grants access to assignees who have a role in the organization associated with the primary or additional job or position. Example: Sarah has a primary position at Company 1 that Mark manages and a secondary position at Company 2 that Susan manages. When you select this option, both Mark and Susan can access Sarah's: Person data. Primary position data for Company 1. Secondary position data for Company 2.

Security Policies

Domain Security Policies

Domain security policies allow you to configure which security groups can access the items in a domain. You can also determine what type of access each security group has to those items (e.g., view-only vs. modify permission).

An item may belong to more than one domain. Use the

Secured Items in Multiple Domains

report to see which items are secured to more than one domain.

View vs. Modify Permission for Reports and Tasks

You can configure two levels of security group permissions in a domain security policy for reports and tasks:

View permission: Provides access only to domain items that require View permissions, such as report fields and data sources. View permission does not provide access to domain items that require Modify permissions.
Modify permission: Provides access to the domain items that require Modify permissions, as well as the items requiring View permissions. Members of security groups with Modify permissions, therefore, can access all of the domain items that require View or Modify permissions.

Example

: Suppose there are 10 items in a domain (3 requiring Modify permissions and 7 requiring View permissions). If you assign a security group View permission to the domain, members of that security group can only access 7 of the items. If you assign another security group Modify permission to the domain, members of that security group can access all 10 items.

Get vs. Put Permission for Integrations

Integration permissions are different from report and task permissions. You can configure two levels of security group permissions in a domain security policy for integrations and other web service operations:

Get permission:
Provides access only to domain items that require Get permissions (e.g., access to extract data from Workday via a web service operation).
Put permission:
Provides access to integration domain items with Put permission (e.g., access to load data into Workday via a web service operation) as well as items with Get permissions. Members of security groups with Put permission, therefore, can access all integrations in the domain.

Note

: Some domain actions and reporting items will show a permission of View Get. This permission indicates that security groups with Get permission can also access actions and reporting items requiring View permission, via integrations.

View a Domain Security Policy

View a domain security policy by selecting Domain > View Security Policy from the domain's Related Actions.

Workday groups the domain items into categories:

Securable Actions:
Include items such as delivered reports and tasks.
Securable Reporting Items:
Include items needed for custom reporting such as data sources, data source filters, and report fields.
Securable Integrations:
Include web service operations secured in the given domain.

Select each count of securable items to view the details of each item and the permission a user needs to access it.

The Process: Credit Card domain security policy with the counts of secured actions, reporting items, and integrations.

Business Process Security Policies

Every business process type has its own business process security policy. Within the security policy, you control which security groups can initiate or take action on the business process. The business process security policy drives which security groups are available to choose from when configuring the business process definition.

You can configure the following types of permissions for a business process type:

Who can start the business process (including what actions initiate the business process).
Who can complete action steps in the business process.
Who can delegate an action to others.
Who can act on an entire business process.
Who can view all.
Who can approve.
Who can cancel.
Who can rescind.
Who can manually advance.
Who can deny.

Multiple Definitions - Singular Policy

You can have multiple business process definitions for a given business process type, but they will share a single security policy. Each definition can route steps to different security groups, as long as they are included in the security policy for the business process type.

Multiple business process definitions, of the same type, share one security policy, but each may route steps to any included security group.

Example

: The Hire business process security policy lists both the Benefits Partner and Compensation Partner security groups as approvers. The Hire definition for IT Helpdesk may route an approval to the Benefits Partner, while the Hire definition for Sales may route to the Compensation Partner.

Editing Business Process Security Policies

Remember, there is only one security policy for each business process type. Edits to the policy will apply to every definition of that type, including organization-specific or rule-based definitions.

You can access the business process security policy in two ways:

From the business process definition's Related Actions.
Using the
Business Process Security Policies for Functional Area
report.

Activate changes to a business process security policy for them to take effect.

Activating Security Policy Changes

Access To Secured Items

View Security for Securable Item

The

View Security for Securable Item

report shows how Workday secures a given item. To quickly locate this report, in the Search box, try entering the shortcut "secura."

Enter a string of text, with a minimum of three characters, in the Securable Item report prompt. The report returns items matching the text string, grouped into sections (e.g., Tasks, Reports, Report Fields, Data Source Filters, Data Sources). Select the View Security button to view the security policy for an item and the currently configured security groups.

View Security for Securable Item report.

Items are either secured to domains or business process types. However, an item can be secured to more than one domain. You can drill into the details and also edit the permissions of the security policy from this report.

View Security for Securable Item example.

Chapter Summary

Automatically (Workday-delivered groups such as public or self-service, e.g., All Employees or Employee as Self)
Manually (User-based security groups such as HR Administrator or Talent Administrator)
Derived based on membership criteria (Role-based security groups, such as HR Partner or Compensation Partner)

Report Fields and Values
View Security for Securable Item
Business Process Security Policies for Functional Areas
Domain Security Policies for Functional Areas
View Security Group