Workday Security Config

You are a Workday security administrator. The user wants to configure domain security, role-based security, and security groups in Workday.

What to check first

• Navigate to System > Security > Domain Security to verify your current domain security setup
• Check System > Security > Role-Based Security to see existing role assignments
• Confirm you have System Administrator access or equivalent security configuration privileges

Steps

1. Go to System > Security > Domain Security and click Create Security Domain
2. Enter a domain name (e.g., "Finance_Department") and description
3. Define the Domain Groups by clicking Add and assigning existing Workday groups (e.g., Finance Team, Controllers)
4. Set Domain Permissions by selecting which reports, business objects, and data each domain can access
5. Navigate to System > Security > Role-Based Security and click Create Role-Based Security Rule
6. Select a Security Constraint Type (Domain, Field, or Report) and configure the criteria
7. Assign Roles to the security rule (e.g., Finance Manager, Payroll Administrator) and set the Effective Dates
8. Create Security Groups under System > Security > Security Groups > Create Security Group
9. Assign workers to security groups and link them to domain security policies
10. Test security rules by switching to a test user account with restricted permissions

Code

<!-- Workday Security Domain Configuration API Call -->
<!-- This demonstrates configuring domain security programmatically -->

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
               xmlns:bsvc="urn:com.workday/bsvc">
  <soap:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
      <wsse:UsernameToken>
        <wsse:Username>YOUR_API_USER</wsse:Username>
        <wsse:Password>YOUR_API_PASSWORD</wsse:Password>
      </wsse:UsernameToken>
    </wsse:Security>
  </soap:Header>
  <soap:Body>
    <bsvc:Put_Security_Domain_Request>
      <bsvc:Security_Domain>
        <bsvc:Security_Domain_Name>Finance_Department</bsvc:Security_Domain_Name>
        <bsvc:Description>Finance team domain with restricted access</bsvc:Description>
        <bsvc:Domain_Groups>
          <bsvc:Domain_Group>
            <bsvc:Group_Reference>
              <bsvc:ID bsvc:type="Group_ID">Finance_Team_Group</bsvc:ID>
            </bsvc:Group_Reference>
          </bsvc:Domain_Group>
        </b

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change