> ## Documentation Index
> Fetch the complete documentation index at: https://help.gowindmill.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workday

> Connect Workday to Windmill to sync employees, managers, departments, and employment data so your org chart and access controls stay accurate automatically.

## Benefits of connecting Workday to Windmill

Connecting Workday to Windmill keeps your employee directory and reporting structure continuously accurate — without manual updates. When Workday is the system of record, Windmill automatically:

* Imports new hires as they join
* Updates manager → direct report relationships in real time
* Reflects promotions, reorgs, and title changes
* Archives employees when they leave the company

This ensures review cycles, 1:1s, and feedback always align to your **current org**, even as teams shift and roles evolve.

## Connected data

Windmill syncs the following employee fields from Workday:

| Field                               | Description                                        |
| ----------------------------------- | -------------------------------------------------- |
| Employee Name                       | Full legal name                                    |
| Work Email                          | Used as the account identity in Windmill           |
| Job Title                           | Displayed in profiles and review flows             |
| Job Level                           | Employee level or grade                            |
| Manager Relationship                | Drives team structure and permissions              |
| Department / Cost Center / Org Unit | Used for grouping and review assignments           |
| Employment Status                   | Automatically archives former employees            |
| Start Date                          | Supports new-hire reviews and onboarding timelines |
| Gender                              | Synced if provided by Workday                      |

Profile pictures sync from [Slack](/integrations/slack), not Workday.

**Windmill does not sync compensation, pay rate, benefits, home address, work location, Social Security Numbers, dates of birth, phone numbers, pronouns, marital status, ethnicity, or employment contracts.** See [Personally Identifiable Information](/security/pii) for the canonical list of fields Windmill collects.

## How to connect Workday to Windmill

Workday offers two authentication methods. Choose the one that best fits your organization:

* **[ISU (Integration System User)](#isu-connection)**: Granular permission control, more restrictive access
* **[OAuth](#oauth-connection)**: Simpler setup, broader access to employee data

## ISU connection

**Best for**: Organizations that need fine-grained permission control over employee data access.

### Setup process

Follow this guide to connect using Basic Authentication (ISU): [Connect Workday using Basic Auth (Integration System User)](https://help.merge.dev/articles/5699428-workday-how-do-i-link-my-account-with-an-integration-system-user)

### 3 critical steps for successful connection

If you're having trouble connecting, verify these minimum requirements:

1. **The account you're using is an Integration System User**
2. **That user is in an Integration System Security Group**
3. **The security group has permissions** — at minimum: **Worker Data: Public Worker Reports**

### ISU permissions

Your Workday admin will need to grant the following permissions to the Integration System User:

| Permission                                         | Notes                                |
| -------------------------------------------------- | ------------------------------------ |
| Worker Data: Public Worker Reports                 | Minimum needed permission to connect |
| Manage: Organization Integration                   |                                      |
| Worker Data: Organization Information              |                                      |
| Person Data: Name                                  |                                      |
| Person Data: Personal Data                         |                                      |
| Person Data: Home Contact Information              |                                      |
| Person Data: Work Contact Information              |                                      |
| Person Data: Private Work Email Integration        |                                      |
| Person Data: Public Work Email Address Integration |                                      |
| Worker Data: All Positions                         |                                      |
| Worker Data: Current Staffing Information          |                                      |
| Worker Data: Employment Data                       |                                      |
| Worker Data: Workers                               |                                      |

**Windmill is read-only and does not write back to Workday.**

## OAuth connection

**Best for**: Organizations prioritizing ease of setup over granular permissions.

### Setup process

Follow this guide to connect using OAuth: [Connect Workday using OAuth](https://help.merge.dev/articles/9891389-workday-how-do-i-link-using-oauth)

### What OAuth enables

OAuth provides broader access with four main permissions that return all employee-related data, including sensitive fields like pay\_rate. This is an "all-or-nothing" access model that simplifies setup but provides less granular control than ISU.

**Windmill is read-only and does not write back to Workday.**

## Managing updates

If you need to:

* Change a manager
* Update someone’s title or team
* Move a person to a new organization
* Terminate / offboard a teammate

> **Make these updates in Workday — not in Windmill.**

Windmill treats Workday as the **system of record**.\
Any updates made directly in Windmill will be **overwritten** on the next sync.

## FAQs

<AccordionGroup>
  <Accordion title="How often does the sync run?">
    Automatically every **24 hours**, with the option to trigger a manual sync in Windmill.
  </Accordion>

  <Accordion title="What is Merge?">
    Merge is the unified API platform that powers Windmill's Workday integration, providing secure and reliable connectivity to your HRIS. [Learn more about Merge](/integrations/merge).
  </Accordion>

  <Accordion title="Does Windmill require Workday implementation or custom integration support?">
    No — Windmill uses standard Workday SCIM + REST APIs. No custom Workday Studio work is required.
  </Accordion>

  <Accordion title="Do we need an Integration System User (ISU)?">
    Only if you're using Basic Authentication. OAuth does not require an ISU. If using Basic Auth, we provide the required permissions and your Workday admin applies them.
  </Accordion>

  <Accordion title="Can we sync multiple entities or supervisory orgs?">
    Yes — Windmill respects your Workday org structure.
  </Accordion>

  <Accordion title="Does the integration include contractors?">
    Only if they appear in Workday as active workers with a manager assigned.
  </Accordion>

  <Accordion title="How do I sync time off data from Workday?">
    Windmill uses time off data to track Days Off as a stat—the total days off for each employee (excluding weekends). This helps provide visibility into team availability and capacity planning.

    If your organization wants to sync time off data from Workday, you'll need to **additionally link via OAuth** on top of your ISU connection. The ISU permissions alone will not grant authorization to time off data, since Workday only surfaces time off information through their REST endpoints (not available via the SOAP endpoint used by ISU).

    **Setup process:**

    1. Keep your existing ISU connection—it's still needed for all other employee data
    2. Follow this additional guide to enable OAuth access for time off: [Accessing Time Off Data from Workday](https://help.merge.dev/articles/8106565-accessing-time-off-data-from-workday?lang=en#step-1-follow-our-main-workday-guide-with-one-minor-difference)

    This dual-authentication approach allows you to maintain granular permission control through ISU while also accessing time off data through OAuth.
  </Accordion>
</AccordionGroup>

***