Workday <> Fleet | Fleet Help Center

👋 Overview

Fleet uses a secure connection to your Workday HRIS — powered by Finch, an industry-leading HRIS integration platform — to automatically sync your employee roster. This streamlines eligibility tracking, onboarding, and ongoing program management, saving your internal team an estimated 20–40 hours per month.

This guide walks your team through the exact steps required to create a Workday Integration System User and configure the necessary permissions.

⏱ Estimated Time to Complete

Typically 5–10 minutes if your team has Workday admin access and the necessary permissions.

If internal reviews are required (e.g., for domain security or authentication policy setup), expect longer cycles — up to a few hours or one business day depending on your internal IT approvals.

🔐 Security & Compliance

Fleet’s connection to Workday is:

Scoped and permissioned — access is limited to the minimum data required for your program setup
Session-restricted — only tokenized, non-UI sessions are used
Credentials never stored — Fleet (via Finch) uses your credentials only to generate secure, revocable sessions

We partner with Finch, a trusted HRIS integration platform that is:

SOC 2 Type II and CCPA compliant
Backed by end-to-end encryption and daily backups
Built with strict data retention and access controls
Automatically purges data upon connection deactivation

Learn more about our HRIS integration partner’s security: Finch Trust Center

🔧 Workday Integration Setup

To connect your Workday account using the Workday API (not the Reports-as-a-Service feature), you must create an Integration System User with the appropriate permissions and provide the login information to Fleet.

Before you start

Please ensure that you have Administrator privileges in Workday before continuing with the instructions below.

Instructions

Step 1. Create an Integration System User in Workday

Log in to your Workday portal.
In the search bar at the top of the page, search for “Create Integration System User”.
Select the Create Integration System User task.
Enter a User Name and Password of your choosing for the new Integration System User. Make sure the password does not contain any of the following characters: “&”, “”, “>”
Save this login information as you'll need it later.
Please ensure that Require New Password at Next Sign In is not checked.
Set Session Timeout Minutes to 0.
Please ensure that Do Not Allow UI Sessions is checked.
Click OK to create the Integration System User.

Step 2. Configure a Security Group

In the search bar at the top of the page, search for “Create Security Group”.
Select the Create Security Group task.
On the Create Security Group page, from the Type of Tenanted Security Group dropdown, select Integration System Security Group (Unconstrained).
Enter a name for the security group in the Name field.
Click OK to create the security group.
On the Edit Integration System Security Group (Unconstrained) page enter the name of the Integration System User you created in the Integration System Users field
Click OK to assign the Integration System User to the security group.

Step 3. Configure the Domain Security Policy Permissions

In the search bar at the top of the page, search for “Maintain Permissions for Security Group”.
Select the Maintain Permissions for Security Group task.
Make sure the Operation is Maintain, and the Source Security Group is the security group you created.
Configure the Domain Security Policy Permissions based on the requirements of the Workday integration you are connecting and the information below.

Required Domain Security Policies

The following Domain Security Policies are the minimum set required for Fleet to securely sync with Workday:

⚠️ Note: View Only will not work. You must select Get Only

View/ Modify Access	Domain Security Policy	Notes
Get Only	Set Up: Company General	Required for authentication
Get Only	Worker Data: Public Worker Reports	Required to fetch basic employee data that is typically made publicly accessible by other employees
Get Only	Worker Data: Current Staffing Information	Required to fetch basic employee job role data

Required Domain Security Policies For Pay Data

The following Domain Security Policies are required for Fleet to securely sync pay data from Workday:

⚠️ Note: View Only will not work. You must select Get Only

View/ Modify Access	Domain Security Policy	Notes
Get Only	Process: Settlement	Required for payroll details
Get Only	Worker Data: Compensation	Required for worker pay details
Get Only	Worker Data: Compensation by Organization	Required for worker pay details

Domain Security Policies

The following Domain Security Policies enable Fleet to retrieve additional data:

NOTE - View Only will not work. You must select Get Only

View/Modify Access	Domain Security Policy	Notes
Get Only	Person Data: Date of Birth	Enables fetching employee date of birth (DOB) on the /individual endpoint
Get Only	Person Data: Work Contact Information	Enables fetching employee work emails and phone numbers
Get Only	Person Data: Home Contact Information	Enables fetching employee personal emails and phone numbers

Step 4. Activate Security Policy Changes

In the search bar at the top of the page, search for “Activate Pending Security Policy Changes”.
Select the Activate Pending Security Policy Changes task.
View the summary of changes waiting to be approved and check the Confirm checkbox

Step 5. Configure Authentication Policy

In the search bar at the top of the page, search for “Manage Authentication Policies”.
Select the Manage Authentication Policies report.
Verify that the Security Group is assigned to a policy that has an Allowed Authentication Type of User Name Password or Any. If this is not the case you must edit the relevant Authentication Policy to add a rule using the steps below:

Edit the Authentication Policy for the environment you want Fleet to retrieve data from
Add a new Authentication Rule for the policy
Set the Authentication Rule Name to a unique value to identify the rule
Set the Security Group to the Security Group you created
Set the Authentication Conditions to Any and the Allowed Authentication Types to Specific > User Name Password.

Step 6. Activate Authentication Policy Changes

In the search bar at the top of the page, search for “Activate Pending Authentication Policy Changes”.
Select the Activate Pending Authentication Policy Changes task.
View the summary of changes waiting to be approved and check the Confirm checkbox

Step 7. Obtain the Web Services Endpoint URL

In the search bar at the top of the page, search for “Public Web Services”.
Select the Public Web Services report.
Find the Human Resources (Public) item in the Web Service column and hover over it so you can click the ... menu that appears.
In the … menu click Web Service > View WSDL. A new page will open containing the technical specifications for the Workday Human Resources Web Service.
Scroll all the way to the bottom of the page and locate the line containing soapbind:address location=. You can also search within the page using Ctrl+F or Cmd+F for the text soapbind:address location=
Copy the URL up until /service. Your resulting Web Services Endpoint URL should look something like https://wd5-services1.myworkday.com/ccx
Save this URL to provide in Fleet's HRIS Connection Widget.

Step 8. Connect Using Fleet's HRIS Connection Widget

Navigate to your Fleet Dashboard.
1. If you’re not automatically redirected to the HRIS connection step, go to:
  My Commuters → Add Commuters → Connect HRIS
2. This will launch Fleet’s HRIS Connection Widget (powered by our secure HRIS partner, Finch).
3. In the widget’s search bar, search for “Workday” in the provider list.
4. Select Workday to begin the setup flow.
Paste the username and password created in Step 1 into the Username and Password fields.
Paste your Workday tenant ID into the Tenant ID field. You can find this value in the URL of your web browser when on the Workday home page:
1. If the URL looks like https://impl.workday.com/somecompany then your tenant ID is somecompany
2. If the URL looks like https://somecompany.workday.com then your tenant ID is somecompany
Paste the Web Services Endpoint URL you copied in Step 7 into the API Base URL field.
Click Connect.

Step 9. Select a Company to Connect

Fleet's HRIS connection Widget will prompt you to select which company you’d like to connect. This list is pulled directly from your Workday system and reflects where employees are assigned.

The company you connect will be the only company Fleet will retrieve data for. If you have other companies you also want to connect you will have to repeat Step 8.

💬 Need Help?

If you run into any issues, contact your Fleet onboarding specialist or message us directly using the chat bubble in the bottom-right corner of the screen.