Workday Integrations Workday-Pro-Integrations Book

The requirement states that the connector output must be transformed before the file is delivered to the endpoint. This means the Document Transformation step must run first, followed by the Document Delivery step.

In Workday, this is managed through the Business Process (BP) attached to the integration system.

From Workday documentation:

“To transform an integration file before delivery, configure the Business Process to run the Document Transformation step before the Document Delivery Service step.”

This ensures that:

The file is converted (via XSLT) to the correct format (e.g., CSV or flat XML)

Only the final, transformed file is sent to the endpoint

Why the others are incorrect:

A. Scheduling separately does not ensure correct sequence.

B. Delivery before transformation would send the wrong file.

D. A separate integration system is unnecessary and not best practice for chained transformations.

This question explores the relationship between an Integration System User (ISU) and an Integration System Security Group (ISSG) in Workday Pro Integrations, focusing on how security is structured for integrations. Let’s analyze the relationship and evaluate each option to determine the correct answer.

Understanding ISU and ISSG in Workday

Integration System User (ISU): An ISU is a dedicated user account in Workday specifically designed for integrations. It acts as a " robot account " or service account, used by integration systems to interact with Workday via APIs, web services, or other integration mechanisms (e.g., EIBs, Core Connectors). ISUs are typically configured with a username, password, and specific security settings, such as disabling UI sessions and setting session timeouts to prevent expiration (commonly set to 0 minutes). ISUs are not human users but are instead programmatic accounts for automated processes.

Integration System Security Group (ISSG): An ISSG is a security container or group in Workday that defines the permissions and access rights for integration systems. ISSGs are used to manage what data and functionalities an integration (or its associated ISU) can access or modify within Workday. There are two types of ISSGs:

Unconstrained: Allows access to all data instances secured by the group.

Constrained: Limits access to a subset of data instances based on context (e.g., specific segments or data scopes).ISSGs are configured with domain security policies, granting permissions like " Get " (read), " Put " (write), " View, " or " Modify " for specific domains (e.g., Worker Data, Integration Build).

Relationship Between ISU and ISSG: In Workday, security for integrations is managed through a hierarchical structure. An ISU is associated with or assigned to an ISSG to inherit its permissions. The ISSG acts as the security policy container, defining what the ISU can do, while the ISU is the account executing those actions. This relationship ensures that integrations have controlled, audited access to Workday data and functions, adhering to the principle of least privilege.

Evaluating Each Option

Let’s assess each option based on Workday’s security model for integrations:

Option A: The ISU is a member of the ISSG.

Analysis: This is correct. In Workday, an ISU is assigned to or associated with an ISSG to gain the necessary permissions. The ISSG serves as a security group that contains one or more ISUs, granting them access to specific domains and functionalities. For example, when creating an ISU, you use the " Create Integration System User " task, and then assign it to an ISSG via the " Assign Integration System Security Groups " or " Maintain Permissions for Security Group " tasks. Multiple ISUs can belong to the same ISSG, inheriting its permissions. This aligns with Workday’s security framework, where security groups (like ISSGs) manage user (or ISU) access.

Why It Fits: The ISU is a " member " of the ISSG in the sense that it is linked to the group to receive its permissions, enabling secure integration operations. This is a standard practice for managing integration security in Workday.

Option B: The ISU owns the ISSG.

Analysis: This is incorrect. In Workday, ISUs do not " own " ISSGs. Ownership or control of security groups is not a concept applicable to ISUs, which are service accounts for integrations, not administrative entities with authority over security structures. ISSGs are created and managed by Workday administrators or security professionals using tasks like " Create Security Group " and " Maintain Permissions for Security Group. " The ISU is simply a user account assigned to the ISSG, not its owner or controller.

Why It Doesn’t Fit: Ownership implies administrative control, which ISUs lack; they are designed for execution, not management of security groups.

Option C: The ISU grants security policies to the ISSG.

Analysis: This is incorrect. ISUs do not have the authority to grant or modify security policies for ISSGs. Security policies are defined and assigned to ISSGs by Workday administrators or security roles with appropriate permissions (e.g., Security Configuration domain access). ISUs are passive accounts that execute integrations based on the permissions granted by the ISSG they are assigned to. Granting permissions is an administrative function, not an ISU capability.

Why It Doesn’t Fit: ISUs are integration accounts, not security administrators, so they cannot modify or grant policies to ISSGs.

Option D: The ISU controls what accounts are in the ISSG.

Analysis: This is incorrect. ISUs do not control membership or configuration of ISSGs. Adding or removing accounts (including other ISUs) from an ISSG is an administrative task performed by users with security configuration permissions, using tasks like " Maintain Permissions for Security Group. " ISUs are limited to executing integration tasks based on their assigned ISSG permissions, not managing group membership.

Why It Doesn’t Fit: ISUs lack the authority to manage ISSG membership or structure, as they are not administrative accounts but integration-specific service accounts.

Final Verification

Based on Workday’s security model, the correct relationship is that an ISU is a member of an ISSG, inheriting its permissions to perform integration tasks. This is consistent with the principle of least privilege, where ISSGs define access, and ISUs execute within those boundaries. The other options misattribute administrative or ownership roles to ISUs, which are not supported by Workday’s design.

Supporting Information

The relationship is grounded in Workday’s integration security practices, including:

Creating an ISU via the " Create Integration System User " task.

Creating an ISSG via the " Create Security Group " task, selecting " Integration System Security Group (Unconstrained) " or " Constrained. "

Assigning the ISU to the ISSG using tasks like " Assign Integration System Security Groups " or " Maintain Permissions for Security Group. "

Configuring domain security policies (e.g., Get, Put) for the ISSG to control ISU access to domains like Worker Data, Integration Build, etc.

Activating security changes via " Activate Pending Security Policy Changes. "

This structure ensures secure, controlled access for integrations, with ISSGs acting as the permission container and ISUs as the executing accounts.

Key References

The explanation aligns with Workday Pro Integrations documentation and best practices, including:

Integration security overviews and training on Workday Community.

Guides for creating ISUs and ISSGs in implementation documentation (e.g., NetIQ, Microsoft Learn, Reco.ai).

Tutorials on configuring domain permissions and security groups for integrations (e.g., ServiceNow, Apideck, Surety Systems).

In Workday integrations, XSLT is used to transform XML data, such as the output from an Enterprise Interface Builder (EIB) or a web service-enabled report, into a desired format for third-party systems. In this scenario, you need to write XSLT to process wd:Dependents_Group elements and output a relationship code based on the value of the wd:Relationship attribute or element. The requirement is to output " SP " for a " Spouse " relationship, " CH " for a " Child " relationship, and " OTHER " for any other relationship, using an < xsl:choose > statement within a template matching wd:Dependents_Group.

Here’s why option C is correct:

XSLT < xsl:choose > Structure: The < xsl:choose > element in XSLT provides conditional logic similar to a switch statement. It evaluates conditions in < xsl:when > elements sequentially, executing the first matching condition, and uses < xsl:otherwise > for any case that doesn’t match.

Relationship as an Attribute: Based on the provided XML snippet, wd:Relationship is an attribute (e.g., < wd:Relationship > Spouse < /wd:Relationship > within wd:Dependents_Group). However, in Workday XML for integrations, wd:Relationship is often represented as an attribute (@wd:Relationship) rather than a child element, especially in contexts like dependent data in reports. The syntax @wd:Relationship in the test attribute of < xsl:when > correctly references this attribute, aligning with Workday’s typical XML structure for such data.

Condition Matching:

The first < xsl:when test= " @wd:Relationship= ' Spouse ' " > SP < /xsl:when > checks if the wd:Relationship attribute equals " Spouse " and outputs " SP " if true.

The second < xsl:when test= " @wd:Relationship= ' Child ' " > CH < /xsl:when > checks if the wd:Relationship attribute equals " Child " and outputs " CH " if true.

The < xsl:otherwise > OTHER < /xsl:otherwise > handles all other cases, outputting " OTHER " if the relationship is neither " Spouse " nor " Child. "

Context in Template: Since the template matches on wd:Dependents_Group, the test conditions operate on the current wd:Dependents_Group element and its attributes, ensuring the correct relationship code is output for each dependent. The XML snippet shows wd:Relationship as an element, but Workday documentation and integration practices often standardize it as an attribute in XSLT transformations, making @wd:Relationship appropriate.

Why not the other options?

A.

xml

WrapCopy

< xsl:choose >

< xsl:when test= " wd:Relationship= ' Spouse ' " > SP < /xsl:when >

< xsl:when test= " wd:Relationship= ' Child ' " > CH < /xsl:when >

< xsl:otherwise > OTHER < /xsl:otherwise >

< /xsl:choose >

This assumes wd:Relationship is a child element of wd:Dependents_Group, not an attribute. The XML snippet shows wd:Relationship as an element, but in Workday integrations, XSLT often expects attributes for efficiency and consistency, especially in report outputs. Using wd:Relationship without @ would not match the attribute-based structure commonly used, making it incorrect for this context.

B.

xml

WrapCopy

< xsl:choose >

< xsl:when test= " @wd:Relationship= ' Spouse ' " > SP < /xsl:when >

< xsl:when test= " @wd:Relationship= ' Child ' " > CH < /xsl:when >

< xsl:otherwise > OTHER < /xsl:otherwise >

< /xsl:choose >

This correctly uses @wd:Relationship for an attribute but has a logical flaw: if wd:Relationship= ' Child ' , the second < xsl:when > would output " CH, " but the order of conditions matters. However, the primary issue is that it doesn’t match the exact structure or intent as clearly as option C, and Workday documentation often specifies exact attribute-based conditions like those in option C.

D.

xml

WrapCopy

< xsl:choose >

< xsl:when test= " /wd:Relationship= ' Spouse ' " > SP < /xsl:when >

< xsl:when test= " /wd:Relationship= ' Child ' " > CH < /xsl:when >

< xsl:otherwise > OTHER < /xsl:otherwise >

< /xsl:choose >

This uses an absolute path (/wd:Relationship), which searches for a wd:Relationship element at the root of the XML document, not within the current wd:Dependents_Group context. This would not work correctly for processing dependents in the context of the template matching wd:Dependents_Group, making it incorrect.

To implement this in XSLT:

Within your template matching wd:Dependents_Group, you would include the < xsl:choose > statement from option C to evaluate the wd:Relationship attribute and output the appropriate relationship code ( " SP, " " CH, " or " OTHER " ) based on its value. This ensures the transformation aligns with Workday’s XML structure and integration requirements for processing dependent data in an EIB or web service-enabled report, even though the provided XML shows wd:Relationship as an element—XSLT transformations often normalize to attributes for consistency.

Workday Pro Integrations Study Guide: Section on " XSLT Transformations for Workday Integrations " – Details the use of < xsl:choose > , < xsl:when > , < xsl:otherwise > , and XPath for conditional logic in XSLT, including handling attributes like @wd:Relationship.

Workday EIB and Web Services Guide: Chapter on " XML and XSLT for Report Data " – Explains the structure of Workday XML (e.g., wd:Dependents_Group, @wd:Relationship) and how to use XSLT to transform dependent data, including attribute-based conditions.

Workday Reporting and Analytics Guide: Section on " Web Service-Enabled Reports " – Covers integrating report outputs with XSLT for transformations, including examples of conditional logic for relationship codes.

To use a custom report as an integration data source, especially through Report-as-a-Service or an EIB-style extract, the report must be configured so Workday can expose its output in a structured service format. Enabling the report as a Web Service allows the report to be called externally or used by integration tools. The Namespace is required so the XML output has a defined structure and can be referenced properly. XML Aliases for fields, group column headings, and prompts are also required because they control the XML element names used in the integration output. Web service aliases and “linking fields” are not the correct required set. Without these report settings, the integration cannot reliably consume the report as a service-based data source.

================