Benefits of Connecting Workday to Windmill
Connecting Workday to Windmill keeps your employee directory and reporting structure continuously accurate — without manual updates. When Workday is the system of record, Windmill automatically:- Imports new hires as they join
- Updates manager → direct report relationships in real time
- Reflects promotions, reorgs, and title changes
- Archives employees when they leave the company
Connected Data
Windmill syncs the following employee fields from Workday:| Field | Description |
|---|---|
| Employee Name | Full legal name |
| Work Email | Used as the account identity in Windmill |
| Job Title | Displayed in profiles and review flows |
| Job Level | Employee level or grade |
| Manager Relationship | Drives team structure and permissions |
| Department / Cost Center / Org Unit | Used for grouping and review assignments |
| Location | Employee work location |
| Employment Status | Automatically archives former employees |
| Start Date | Supports new-hire reviews and onboarding timelines |
| Profile Picture | Employee avatar from Workday |
How to Connect Workday to Windmill
Workday offers two authentication methods. Choose the one that best fits your organization:- ISU (Integration System User): Granular permission control, more restrictive access
- OAuth: Simpler setup, broader access to employee data
ISU Connection
Best for: Organizations that need fine-grained permission control over employee data access.Setup Process
Follow this guide to connect using Basic Authentication (ISU): Connect Workday using Basic Auth (Integration System User)3 Critical Steps for Successful Connection
If you’re having trouble connecting, verify these minimum requirements:- The account you’re using is an Integration System User
- That user is in an Integration System Security Group
- The security group has permissions — at minimum: Worker Data: Public Worker Reports
ISU Permissions
Your Workday admin will need to grant the following permissions to the Integration System User:| Permission | Notes |
|---|---|
| Worker Data: Public Worker Reports | Minimum needed permission to connect |
| Manage: Organization Integration | |
| Worker Data: Organization Information | |
| Person Data: Name | |
| Person Data: Personal Data | |
| Person Data: Home Contact Information | |
| Person Data: Work Contact Information | |
| Person Data: Private Work Email Integration | |
| Person Data: Public Work Email Address Integration | |
| Worker Data: All Positions | |
| Worker Data: Current Staffing Information | |
| Worker Data: Employment Data | |
| Worker Data: Workers |
OAuth Connection
Best for: Organizations prioritizing ease of setup over granular permissions.Setup Process
Follow this guide to connect using OAuth: Connect Workday using OAuthWhat OAuth Enables
OAuth provides broader access with four main permissions that return all employee-related data, including sensitive fields like pay_rate. This is an “all-or-nothing” access model that simplifies setup but provides less granular control than ISU. Windmill is read-only and does not write back to Workday.Managing Updates
If you need to:- Change a manager
- Update someone’s title or team
- Move a person to a new organization
- Terminate / offboard a teammate
Make these updates in Workday — not in Windmill.Windmill treats Workday as the system of record.
Any updates made directly in Windmill will be overwritten on the next sync.
FAQs
How often does the sync run?
How often does the sync run?
Automatically every 24 hours, with the option to trigger a manual sync in Windmill.
What is Merge?
What is Merge?
Merge is the unified API platform that powers Windmill’s Workday integration, providing secure and reliable connectivity to your HRIS. Learn more about Merge.
Does Windmill require Workday implementation or custom integration support?
Does Windmill require Workday implementation or custom integration support?
No — Windmill uses standard Workday SCIM + REST APIs. No custom Workday Studio work is required.
Do we need an Integration System User (ISU)?
Do we need an Integration System User (ISU)?
Only if you’re using Basic Authentication. OAuth does not require an ISU. If using Basic Auth, we provide the required permissions and your Workday admin applies them.
Can we sync multiple entities or supervisory orgs?
Can we sync multiple entities or supervisory orgs?
Yes — Windmill respects your Workday org structure.
Does the integration include contractors?
Does the integration include contractors?
Only if they appear in Workday as active workers with a manager assigned.
How do I sync time off data from Workday?
How do I sync time off data from Workday?
Windmill uses time off data to track Days Off as a stat—the total days off for each employee (excluding weekends). This helps provide visibility into team availability and capacity planning.If your organization wants to sync time off data from Workday, you’ll need to additionally link via OAuth on top of your ISU connection. The ISU permissions alone will not grant authorization to time off data, since Workday only surfaces time off information through their REST endpoints (not available via the SOAP endpoint used by ISU).Setup process:
- Keep your existing ISU connection—it’s still needed for all other employee data
- Follow this additional guide to enable OAuth access for time off: Accessing Time Off Data from Workday