Smart Workday Tenant Requirements

Transcription

1 Smart requires specific configuration on your Workday tenants to enable it to execute automated tests. At a high level this includes: A Smart Integration System User A Security Group with specific Domain Security Policies Updating Business Process Security Policies to allow Smart to Cancel and Rescind transactions via web service Custom Reports and Calculated Fields You can provision any non-production Workday tenant for Smart. If you are already live with Workday, then due to the Sandbox tenant refresh process you will need apply this configuration to your testing tenants after every refresh from Production. Kainos will perform the initial configuration but we recommend that customers take ownership of the process. The provisioning process is known as Self Service Provisioning (SSP), and can be automated by a single button click from within the customer s Smart tenant. If you would like to have your Workday tenant configured to allow SSP, please contact the Kainos Smart Customer Support team for more information. Smart Workday Tenant Requirements During Onboarding and initial tenant setup, the Kainos Smart Professional Services team will require access to your Workday tenant(s), to apply configuration and enable Smart to execute tests against them. To fulfill this, a member of the Kainos Smart Professional Services/Smart Customer Support team should be setup with a named user account on your Workday tenant(s). As a minimum we recommend one named user from Kainos Smart Professional Service/Smart Customer Support being set up with access to apply Smart configuration to a Workday tenant. However, we advise that additional users from the Kainos Smart Professional Services/Smart Customer Support team are also created, to ensure that your use of Smart can be supported more effectively. Kainos recommends that customers create an Implementer Account for the Kainos Named User e.g. jsmithimpl. Alternatively, if granting implementer access is not possible, customers can grant required access by following these steps: 1. Create a named, Integration System User e.g. jsmith-smart 2. Create new Integration System Security Group (Unconstrained) called Kainos Smart Users 3. Grant Domain Security permissions listed below (required set of permissions to launch SSP): Policy View Modify Get Put Security Administration FALSE TRUE FALSE FALSE Page 1

2 Security Configuration FALSE TRUE FALSE FALSE Business Process Administration Set Up: Tenant Setup - HCM FALSE TRUE FALSE FALSE Integration Security FALSE TRUE FALSE FALSE Workday Accounts FALSE TRUE FALSE FALSE Custom Report Creation FALSE TRUE FALSE TRUE Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE Manage: All Custom Reports FALSE FALSE FALSE TRUE Security Activation FALSE TRUE FALSE FALSE If customers are live with Workday, it is recommended that this access is created in the Production environment, putting in place an authentication policy that will block access to Production, but allow the accounts to copy down into your testing tenants after a refresh. For more information on the creation of this authentication policy, please see the section on Workday Authentication Policies. Configuring non-production Workday tenants for Smart Users with implementer or equivalent level of access to their Workday tenant will have the option of launching the SSP process from within Smart, described in the Launching SSP on a New Test Tenant section. SSP will apply the following configuration on the non-production Workday tenant: Maintain User Name Rules to ensure the user name length is 22 characters or more - required to create the Smart System User. Create Integration System System User called "kainossmart-intsysuser" Create a single Integration System Security Groups (Unconstrained): Kainos Smart Permissions Group with the following permissions: Policy View Modify Get Put Worker Data: Compensation Grade Business Process Administration FALSE TRUE TRUE FALSE Worker Data: Benefit Eligibility Person Data: Birth Place Worker Data: Business Title on Worker Profile Page 2

3 Person Data: ID Information Worker Data: International Assignments Worker Data: Payroll (Pay Group Specific) Worker Data: Payroll Interface (Pay Group Specific) Worker Data: Payroll Interface (Tax Elections) Worker Data: Worker Summary Reports View: Business Asset Reports: Business Assets Custom Report Administration FALSE TRUE FALSE TRUE Custom Report Creation FALSE TRUE FALSE TRUE Integration Process FALSE FALSE FALSE TRUE Integration Reports FALSE TRUE FALSE TRUE Manage: Address Information Integration Build Manage Pre-Hire Process: Consider Pre- Hires Manage: Supervisory Organization Reports: Manager Reports: Manager (Pre-Hire) Search: Find Worker Set Up: Base and Plan Set Up: Leave of Absence Worker Data: Active and Terminated Workers Worker Data: All Positions Worker Data: Beneficiaries and Dependents Page 3

4 Worker Data: Compensation by Organization Worker Data: Compensation Summary by Job Profile Worker Data: Current Staffing Information Person Data: Date of Birth Person Data: Disabilities Worker Data: Documents Person Data: Emergency Contacts Worker Data: Employee Contracts Person Data: Gender Person Data: Home Address Worker Data: Leave of Absence Worker Data: Public Worker Reports Person Data: Religion Worker Data: Retirement Savings Worker Data: Stock Grants Worker Data: Talent Worker Data: Terminations Person Data: Work Address Person Data: Work Person Data: Work Instant Messenger Person Data: Work Phone Worker Data: Work Shifts Person Data: Work Web Address Business Process Delegation FALSE TRUE TRUE FALSE Configuration Set: Custom Reports and Fields FALSE FALSE FALSE TRUE Page 4

5 Manage: All Custom Reports FALSE TRUE FALSE TRUE Workday Accounts FALSE TRUE FALSE TRUE Academic Units: View Appointee Data: Current Appointments Audit: Contact Information Business Process Reporting Candidate Data: Background Check History Compensation Change: Total Base Pay Job Information Job Requisition Data Manage Pre-Hire Process: Manage Pre- Hires Manage Pre-Hire Process: Pre-Hire Eligibility Manage: Company Manage: Location Manage: Organization Roles Pre-Hire Data: Background Check Status Reports: Open Positions Set Up: Benchmark Jobs Set Up: Organization Set Up: Stock Set Up: Time Off (Calculations - Absence Specific) Worker Data: Active Employees Worker Data: Background Check Status Worker Data: Benefit Elections Worker Data: Benefits Page 5

6 Person Data: Citizenship Status Worker Data: Collective Agreements Worker Data: Contingent Worker Assignment Details Person Data: Ethnicity Worker Data: Funded Plan Assignments Worker Data: Headcount Reports Worker Data: Historical Staffing Information Person Data: Home Person Data: Home Instant Messenger Person Data: Home Phone Person Data: Home Web Address Person Data: Marital Status Worker Data: Market Position Details Person Data: Medical Exams Person Data: Military Status Worker Data: Payroll (Company Specific) - USA Worker Data: Payroll (Costing Override) Worker Data: Payroll Interface (Costing Overrides) Worker Data: Performance Reviews Worker Data: Period Activity Pay Worker Data: Probation Periods Worker Data: Retirees Worker Data: Staffing Worker Data: Staffing Reports with Compensation Data Page 6

7 Worker Data: Time Off (Time Off) Set Up: Contact Info, IDs, and Personal Data FALSE TRUE FALSE FALSE Process: I-9 Forms - USA FALSE FALSE TRUE FALSE Worker Data: I-9 Forms - USA FALSE FALSE TRUE FALSE Find Candidates: Internal and External FALSE FALSE TRUE FALSE Worker Data: Unions FALSE FALSE TRUE FALSE Person Data: Nationalities FALSE FALSE TRUE FALSE Talent Pool: View and Edit Worker Data: Succession Worker Data: Calibration Worker Data: Employee Reviews Worker Data: Compensation Management by Organization Worker Data: Business Assets Worker Data: Payroll (Payment Elections) Custom Label Management FALSE FALSE TRUE FALSE Reports: Financial Accounting TRUE FALSE FALSE TRUE Reports: Customer Accounts Reports: Supplier Accounts Process: Journals (NEW) TRUE FALSE FALSE TRUE Process: Journals - View TRUE FALSE FALSE TRUE Process: Supplier Invoice Integrations: Workfeed Process: Receipt Process: Requisition Process: Supplier Contract (NEW) Page 7

8 Reports: Supplier View: Supplier Set Up: Credit Card Worker Data: Veteran Status Identification Recruiting Agency Careers Job Requisitions for Recruiting Non-Worker: Compensation Data by Organization Process: Supplier Invoice - Reporting FALSE FALSE FALSE TRUE Process: Customer Invoice Payment View: Customer Process: Customer Contract Process: Project Billing Configuration Set: Business Processes FALSE FALSE TRUE FALSE Business Process Definition View FALSE FALSE TRUE FALSE Manage: Organization Integration FALSE FALSE TRUE FALSE Reports: Supplier Accounts 1099 Process: Expense Report Process: Spend Authorization Manage: Service Center Set Up: Payroll - Pay Group Specific Worker Data: Time Off (Time Off Balances) Set Up: Payroll (Calculations - Payroll Specific) Process: Customer Invoice - Change Process: Customer Invoice - View Security Administration FALSE TRUE FALSE FALSE Page 8

9 Security Configuration Process: Expense Report - View Reports: Pay Calculation Results (Results - Security based on Pay Component Security) Reports: Pay Calculation Results (Results - Reports based on Pay Component Security) Process: Ad Hoc Payment - View Process: Purchase Order - Reporting Process: Requisition - View FALSE FALSE TRUE FALSE Process: Purchase Order Reports: Pay Calculation Results for Worker (Results) Reports: Pay Calculation Results for Worker (Payslips) Reports: Pay Calculation Results for Pay Group (Results) - USA Reports: Pay Calculation Results for Pay Group (Results) - CAN Reports: Pay Calculation Results for Pay Group (Results) - FRA Reports: Pay Calculation Results for Pay Group (Results) - UK Reports: Pay Calculation Results for Pay Group (Results) Process: Customer Contract - View Worker Data: Payroll (Payroll Input) FALSE FALSE FALSE TRUE Run Batch Calculations (Pay Calculation) FALSE FALSE FALSE TRUE Process: Spend Authorization - View TRUE TRUE FALSE FALSE Process: Receipt/Return - View TRUE TRUE FALSE FALSE Add Kainos Smart Permissions Group to Cancel and Rescind web service Actions for the following Business Processes: Page 9

10 Business Process Type Cancel (Web Service) Rescind (Web Service) Add Academic Appointment Y Y Add Additional Job Y Y Add Retiree Status Y Y Assign Costing Allocation Y Y Assign Employee Collective Agreement Y Y Assign Pay Group Y Y Assign Pay Group for Position Restrictions Event Y Y Assign Roles Y Y Assign Superior Y Y Background Check Y Y Change Benefit Jobs Y Y Change Benefits Y Y Change Benefits for Life Event Y Y Change Default Compensation Y Y Change Emergency Contacts Y Y Change Job Y Y Change Organization Assignments for Worker Y Y Complete Federal Withholding Elections Y Y Complete Form I-9 Y N Correct Time Off Y N Create Position Y Y Create Workday Account Y Y Edit Government IDs Y Y Edit ID Information Y Y Edit Licenses Y Y Page 10

11 Edit Other IDs Y Y Edit Position Y Y Edit Position Restrictions Y Y Employee Contract Y Y End Academic Appointment Y Y Evergreen Requisition Y Y Freeze Position Y Y Hire Y Y Hiring Restrictions Y Y Edit Hiring Restrictions Y Y Job Requisition Y Y Manage Probation Period Y Y Onboarding Y N Passports and Visa Change Y Y Period Activity Pay Y Y Personal Information Change Y Y Propose Compensation Hire N Y Propose Compensation Change N Y Remove Retiree Status Y Y Request Compensation Change Y Y Request Delegation Change Y N Request Leave of Absence Y Y Request One-Time Payment Y Y Request Return from Leave of Absence Y Y Request Stock Grant Y Y Request Time Off Y N Page 11

12 Review COBRA Eligibility Event Y Y Service Dates Change Y Y Termination Y Y Update Academic Appointment Y Y Create Subordinate Y Y Service Dates Change Y Y End International Assignment Y Y Start International Assignment Y Y Switch Primary Job Y Y Assign Work Schedule Y Y Contract Contingent Worker Y Y Contact Change Y Y Dependent Event Y Y Complete Federal Withholding Elections Y Y Complete State and Local Withholding Elections Y Y End Contingent Worker Contract Y Y Severance Worksheet Y Y Manage Education Y Y Edit Workday Account Y Y Union Membership Event Y Y End Additional Job Y Y Assign Matrix Organization Y Y Home Contact Change Y Y Work Contact Change Y Y Edit Password Rules and set following values to 0: Days Before Password May Be Re-used Number of Passwords before Password Reuse Page 12

13 Set kainossmart-intsysuser Preferred Locale and Preferred Language to English (United States) en_us Activate Pending Security Policy Changes Upload Smart Calculated Fields and Custom Reports, which are required for Smart to operate on a customer Workday tenant Upon SSP completion, the Proxy Access Policy should be configured in order to allow Smart to proxy on behalf of All Users Security Group. If you are live with Workday it is recommended to configure the Proxy Access Policy for non-production Workday tenants in your Production tenant, so it automatically propagates to any testing tenants refreshed from Production. If SSP is enabled on the Smart tenant and the provisioned Workday tenant has been refreshed, its status will be set to Configuration Missing. To re-initiate the SSP process, please refer to Re-launching SSP section. Launching SSP on a New Test Tenant 1. First, select the Workday Tenants option from the Smart ADMIN menu. This will bring you to the tenant configuration screen. 2. Select Create New. This will present the user with a slightly modified Tenant Configuration screen. Instead of the option to Save, users have the option to Apply Configuration. The details populated on this page are the same required when creating a new tenant (see the section Creating a New Workday Tenant): Page 13

14 Additional options are available for SSP that will depend on the configuration of the Workday tenant: Edit Tenant Setup - Do not display Position ID Edit Tenant Setup - Do not display Position ID will uncheck the 'Do not display Position ID' option in Edit Tenant Setup - HCM on the Workday tenant. It is unchecked by default, however depending on the configuration of the Workday tenant, this option may need to be checked when running SSP. If unsure whether or not this option needs checked, please discuss this with your Smart representative. When all details have been correctly entered, select Apply Configuration. The following prompt will appear: Page 14

15 At this point, users can enter their implementer or equivalent credentials and select Verify. Smart will verify that these credentials are at a sufficient level in order to initiate the process and, providing this is true, present a step-by-step progress table detailing where in the SSP process it currently is. More information on the required permissions is available by clicking What is an equivalent level of access? This will display a list of domain permissions that are necessary to successfully complete the provisioning process. The list is as follows: When SSP has been successfully initiated, the Tenant Configuration screen will be updated to show the progress of the process step-by-step: Page 15

16 3. Once SSP has completed, the Smart user who initiated the process will receive a notification to their inbox providing the status of the Workday tenant (i.e. Successfully Configured), as well as information regarding the execution time for SSP. If you wish for a member of the Kainos Smart Customer Support team to carry out the process of adding a new tenant, they will need to be granted named user access on the relevant Workday tenant, as well as the necessary security permissions to carry out the process. Please contact the Kainos Smart Customer Support team for further information. Re-launching SSP With SSP enabled, if users wish to re-configure their tenants after a weekly refresh, it is simply a matter of navigating to the Tenant Configuration page and selecting Edit beside the tenant which needs to have the configuration re-applied. The Tenant Configuration screen will be presented, along with an option to Retry the provisioning process. At this point the Workday Credentials screen shown above will prompt the user for valid credentials, which will be verified and used to re-executed the SSP process. Once again, when completed, the initiating user will receive a summary to their address. Cannot Login If your Workday tenant status in Smart is set to Cannot Login, and the Workday tenant in question has not had a refresh, this is indicative that the kainossmart-intsysuser account exists, however Smart cannot currently access the Workday tenant. This can be caused by the following: Account Expiry - If it has been a while since the kainossmart-intsysuser account was created the account may have expired, and will need to have either its expiry date extended, or an expiry exemption put in place. Account Locked/Deactivated - If the kainossmart-intsysuser account has been locked/deactivated, it will need to have its access restored. Authentication Policy Changes - If any changes have been made to the Authentication Policy (if applicable), these will need to be checked and verified that the kainossmart-intsysuser's rule is still in effect. Once the corrective action is taken, the Workday tenant in Smart will update to show as Successfully Configured, and will again be available for testing. Reset Password If for any reason kainossmart-intsysuser password has been/is required to be changed, the Reset Password functionality can be used to allow Smart to safely set and store a new secure password for the kainossmart-intsysuser account. To initiate a password reset, navigate to Workday Tenant Configurations screen and click the Reset Password link beside the Workday tenant, which you would like to reset the password for. Page 16

17 At this point, Smart will ask for suitable credentials to use that will allow for resetting kainossmartintsysuser password. Once the process is completed, the Workday tenant status will update to Successfully Configured, and will again be available for testing. Page 17