Benefits of connecting Workday to Windmill
Connecting Workday to Windmill keeps your employee directory and reporting structure accurate without manual updates. When Workday is the system of record, Windmill automatically:- Imports new hires as they join
- Updates manager → direct report relationships
- Reflects promotions, reorgs, and title changes
- Archives employees when they leave the company
Connected data
Windmill syncs the following employee fields from Workday:
Profile pictures sync from Slack, not Workday.
Windmill can also sync personal email, work location, and time-off records when Workday provides them and the connection has the required authorization.
Windmill does not store compensation, pay rate, benefits, home address, Social Security Numbers, dates of birth, phone numbers, pronouns, marital status, ethnicity, or employment contracts as employee-profile fields. See Personally Identifiable Information for the canonical list of fields Windmill collects.
How to connect Workday to Windmill
Workday offers two authentication methods. Choose the one that best fits your organization:- ISU (Integration System User): Granular permission control, more restrictive access
- OAuth: Simpler setup, broader access to employee data
ISU connection
Best for: Organizations that need fine-grained permission control over employee data access.Setup process
Follow this guide to connect using Basic Authentication (ISU): Connect Workday using Basic Auth (Integration System User)3 critical steps for successful connection
If you’re having trouble connecting, verify these minimum requirements:- The account you’re using is an Integration System User
- That user is in an Integration System Security Group
- The security group has permissions — at minimum: Worker Data: Public Worker Reports
ISU permissions
Your Workday admin will need to grant the following permissions to the Integration System User:
Windmill is read-only and does not write back to Workday.
OAuth connection
Best for: Organizations prioritizing ease of setup over granular permissions.Setup process
Follow this guide to connect using OAuth: Connect Workday using OAuthWhat OAuth enables
OAuth provides broader access with four main permissions that return all employee-related data, including sensitive fields like pay_rate. This is an “all-or-nothing” access model that simplifies setup but provides less granular control than ISU. Windmill is read-only and does not write back to Workday.Managing updates
If you need to:- Change a manager
- Update someone’s title or team
- Move a person to a new organization
- Terminate / offboard a teammate
Make these updates in Workday — not in Windmill.Windmill treats Workday as the system of record.
Any updates made directly in Windmill will be overwritten on the next sync.
FAQs
How often does the sync run?
How often does the sync run?
Automatically every 24 hours, with the option to trigger a manual sync in Windmill.
What is Merge?
What is Merge?
Merge is the unified API platform that powers Windmill’s Workday integration, providing secure and reliable connectivity to your HRIS. Learn more about Merge.
Does Windmill require Workday implementation or custom integration support?
Does Windmill require Workday implementation or custom integration support?
No — Windmill uses standard Workday SCIM + REST APIs. No custom Workday Studio work is required.
Do we need an Integration System User (ISU)?
Do we need an Integration System User (ISU)?
Only if you’re using Basic Authentication. OAuth does not require an ISU. If using Basic Auth, we provide the required permissions and your Workday admin applies them.
Can we sync multiple entities or supervisory orgs?
Can we sync multiple entities or supervisory orgs?
Yes — Windmill respects your Workday org structure.
Does the integration include contractors?
Does the integration include contractors?
Only if they appear in Workday as active workers with a manager assigned.
How do I sync time off data from Workday?
How do I sync time off data from Workday?
Windmill uses time off data to track Days Off as a stat—the total days off for each employee (excluding weekends). This helps provide visibility into team availability and capacity planning.If your organization wants to sync time off data from Workday, you’ll need to additionally link via OAuth on top of your ISU connection. The ISU permissions alone will not grant authorization to time off data, since Workday only surfaces time off information through their REST endpoints (not available via the SOAP endpoint used by ISU).Setup process:
- Keep your existing ISU connection—it’s still needed for all other employee data
- Follow this additional guide to enable OAuth access for time off: Accessing Time Off Data from Workday