Workday Recruiting Security

Constrained security groups enforce a context on members' target access. If you add a constrained security group to a security policy, members can access secured items in those policies. Once there, Workday applies context to the target data. The constraints are by organization typically.

Alternatively, unconstrained security groups do not enforce a context. If you add an unconstrained security group to a security policy, members can access secured items in those policies with no context or constraint applied.

Workday HCM activities rely on constrained security groups. This means recruiters can only manage candidates on job requisitions they own. Workday requires unconstrained, role-based security groups for some domains.

These unconstrained security groups are:

You may encounter new roles and security groups when defining Workday Recruiting security policies and business processes.

Below are suggestions of workers who you may assign to these security groups:

Two ways you can assign tasks to recruiters or recruiting users include:

Workers participate in business processes based on their assigned roles. To configure roles for a business process, add the appropriate role-based security groups to the business process security policy. The Recruiter then receives the business process tasks based on the role assignments at the organization and specific business process steps.

When you assign the Primary Recruiter role or other ad hoc roles to the job requisition, these roles manage specific job requisitions and recruiting tasks. You can assign multiple roles to a job requisition.

If you use the Job Requisition Workspace, you can assign a default recruiting role and add up to four additional recruiting role filters. Use the

Maintain Job Requisition Workspace

task to configure the roles.

Domains are a collection of items that share the same security, including:

Domain security policies control which security groups can access data in the domain.

Domain security policies allow you to configure which security groups can access the items in a domain. You can also determine what type of access each security group has to those items (e.g., view-only vs. modify permission).

By default, the child security policies inherit permissions granted at the parent level. To remove inheritance, edit the child security policy. You can change the inheritance for each child policy individually without affecting the other child policies. To restore the default inheritance, select the Use Parent Permissions button.

When you view a domain security policy or security domain, Workday displays which security group types you can add. You can enable or suspend security policies for each parent and child domain.

Workday occasionally adds new domains. Enable a new domain and edit security groups before you can use the new functionality.

Whenever you change a security policy or its permissions, initiate the

Activate Pending Security Policy Changes

task.

In Workday Recruiting, you will configure domain security policies to access the Recruiting Hub, candidate data, questions, and questionnaires, to name a few. Locate security policies in the following domains and corresponding functional areas:

Business process definitions include many different characteristics. The header section displays the effective date, security groups allowed to initiate the process, and a button to view a visual representation of the process flow. The body of the business process definition includes the following tabs of information:

Below is an example:

Workday defines the business process types delivered in each functional area. Every business process type has its own business process security policy. The business process security policies secure the permissions that members of security groups have for a specific business process type. Some examples of these permissions include initiating, approving, delegating, and canceling business processes. Each business process type has a single security policy that secures all business process definitions of its type.

In Workday Recruitng, there are several common business process types that you must configure in order to hire a candidate. You can have multiple business process definitions for a given business process type, but they will share a single security policy. You can configure each definition to route steps to different security groups, as long as you include those groups in the security policy for the business process type.

The Business

Process Security Policies for Functional Area

report provides the description of a business process type and all business processes and sub-processes for that functional area.

To edit a business process security policy, use the definition's Related Actions, then select Business Process Policy > Edit. Before any security policy changes take effect, you must run the

Activate Pending Security Policy Changes

task. Once the security policy updates, you can then edit a business process definition. To edit a business process definition, use the definition's Related Actions, then select Business Process > Edit Definition.