--- title: "Workday Security: A Tactical Guide to Configuration and Maintenance" description: Security in Workday is extensive and can seem daunting. Find out how we've helped customers like you to configure and maintain their setup in a secure and sustainable way. image: https://blog.invisors.com/hubfs/Untitled%20design%20(18).png --- [![BlackLogo](https://blog.invisors.com/hs-fs/hubfs/Logos/BlackLogo.png?width=1200&height=450&name=BlackLogo.png "BlackLogo")](https://www.invisors.com/) - Services - [AI Workday Services](https://www.invisors.com/workday-ai) - [Workday Financial Management](https://www.invisors.com/workday-financial-management) - [Workday Human Capital Management](https://www.invisors.com/workday-human-capital-management) - [Workday Adaptive Planning](https://www.invisors.com/workday-adaptive-planning) - [Workday Analytics](https://www.invisors.com/workday-analytics-deployment) - [Workday Support](https://www.invisors.com/workday-support) - [Workday Extend + Built on Workday](https://www.invisors.com/workday-extend) - [Workday Change Management](https://www.invisors.com/workday-change-management) - Resources - [Not Yet on Workday](https://www.invisors.com/not-yet-on-workday-tools) - [Already Live on Workday](https://www.invisors.com/live-on-workday-tools) - [Customers](https://www.invisors.com/customers) - [Company](https://www.invisors.com/company-overview) - [Overview](https://www.invisors.com/company-overview) - [Methodology](https://www.invisors.com/methodology) - [Careers](https://www.invisors.com/careers) - [Community](https://www.invisors.com/community) - [Events](https://www.invisors.com/events) - [News](https://www.invisors.com/news) - [Contact](https://www.invisors.com/contact) - Services - [AI Workday Services](https://www.invisors.com/workday-ai) - [Workday Financial Management](https://www.invisors.com/workday-financial-management) - [Workday Human Capital Management](https://www.invisors.com/workday-human-capital-management) - [Workday Adaptive Planning](https://www.invisors.com/workday-adaptive-planning) - [Workday Analytics](https://www.invisors.com/workday-analytics-deployment) - [Workday Support](https://www.invisors.com/workday-support) - [Workday Extend + Built on Workday](https://www.invisors.com/workday-extend) - [Workday Change Management](https://www.invisors.com/workday-change-management) - Resources - [Not Yet on Workday](https://www.invisors.com/not-yet-on-workday-tools) - [Already Live on Workday](https://www.invisors.com/live-on-workday-tools) - [Customers](https://www.invisors.com/customers) - [Company](https://www.invisors.com/company-overview) - [Overview](https://www.invisors.com/company-overview) - [Methodology](https://www.invisors.com/methodology) - [Careers](https://www.invisors.com/careers) - [Community](https://www.invisors.com/community) - [Events](https://www.invisors.com/events) - [News](https://www.invisors.com/news) - [Contact](https://www.invisors.com/contact) Workday Workday Security # Workday Security: A Tactical Guide to Configuration and Maintenance On June 6, 2024 ![Kelly Bradley, Area Manager](https://blog.invisors.com/hubfs/Kelly%20Bradley.png) Kelly Bradley Connect with a Workday expert ![](https://blog.invisors.com/hubfs/Untitled%20design%20(18).png) #### Contact an expert **Security in Workday is extensive and can seem daunting. Organizations will often have a Security Administrator role but no process in place to regularly audit their security setup. Common questions we receive are:** - **How do we ensure our tenant is secure?** - **What audits should we be performing?** - **How do we carry out these audits?** - **How do we see who has access to sensitive data?** **Below are some steps we've helped customers like you take to configure and maintain their setup in a secure and sustainable way. Let's take your Security Administrators from reactive to strategic!** # 1 |   Outline your design  Define these key elements:  - Who should be able to take which actions?   - Who should be able to view what content? - Your process to gather and approve security change requests Define your key stakeholders:  - Who should the members of your Workday Security team be that will handle configuration?  - Who are your Workstream Super Users that will provide insights into business needs?  As your company evolves so will your definitions and stakeholders. We recommend maintaining a master file to house this information that you can revisit every 6 months. This would be a good use case for Worksheets. You can also use this to verify that any new additions or updates are following your specified requirements.   # 2 |      Complete these important activities to set you up for success  Secure your tenant:  - Have you defined authentication policies for worker types with varying levels of restriction?  - Are you using Multi-Factor Authentication?  - Are you using SSO?  - Are you using strong passwords? - Are you regularly monitoring user signons via: - Signons and Attempted Signons  - Workday Accounts Currently Locked Out by Excessive Failed Signon Attempts  Familiarize yourself with the current Setup:  Look at your:  - Admin/Modify security groups.  - These users have a lot of access. Should they in fact be able to configure in these areas? The members should be limited.  - Partner security groups.  - Can these groups view the data and perform the processes they need daily? Do they have any additional/unnecessary access.  - View security groups. - Should these users be able to view these processes and/or data points?  - Business Process Policies/step recipient groups to ensure consistency across processes. - Limit initiators  - Analyze approvers  - Analyze Cancel, Rescind, Correct access  - Members of your riskiest security group types (e.g. user based, and role based unconstrained).  - Sensitive business process types (e.g. compensation, personal data).  It is easiest to view security by Functional Area to ensure, for each grouping, the right people have the right access.    # 3 |    Utilize WD Delivered Reports for Initial Audits  Example audits:  - Audit workers User Based security groups and Assignable Roles. Look at the user’s location, job profile, job category, job family. Are there any outlier assignments? Via:  - Role Assignments for Worker Position  - Roles for Organization and Subordinates  - View Security Groups  - Find non-admin security groups with modify/view access. Paying special attention to Set Up domains. Find any security groups with access to incorrect domains for a functional area. Via:  - Domain Security Policies for Functional Area   - Find and inactivate any security groups without permissions/that are no longer in use or that have no members. Via:  - Security Groups Not Referenced in any Security Policy  - View Security Group - Verify members of extremely sensitive groups: Setup Admin, Security Configurator, Business Process Admin. Via:  - View Security Group - Review recent Domain/Business Process Policy changes. Via:  - Business Process Security Policies Changed within Time Range - Domain Security Policies Change within Time Range  - Review Organizations missing role assignments. Via:  - Unassigned Organization Roles Audit  - Find sensitive business processes and ensure approval steps and accurate policy access via:  - Business Process Policies for Functional Area - Business Process Types and Initiating Security Groups - Business Process Booklet or Extract Business Process Definition - Find any non-admin/non-partner groups that can correct processes. Via:  - Action Summary for Security Group - Security Analysis for Security Groups # 4 |    Build out your Custom Reports to fill in Gaps   Delivered reports can get you started but there are many custom reports Invisors can build to get you even further. Below are a few of our favorites.   Security Overview:  Security Group access to functional areas and the number of domains granted permissions in that area. This report helps you quickly determine security groups with access to domains in a functional area that they shouldn't have (eg. compensation or personal data). Or incorrect permissions assigned e.g. Modify vs View access. And the specific domains you need to update to remove incorrect access.  ![](https://blog.invisors.com/hs-fs/hubfs/image%20(18)-png.png?width=1757&height=477&name=image%20(18)-png.png) Business Process Access by Functional Area: This report allows you to dig into your security groups ability to initiate, correct, rescind, or cancel a business process by functional area. ![image (19)](https://blog.invisors.com/hs-fs/hubfs/image%20(19).png?width=1876&height=453&name=image%20(19).png) Business Process Policy Details:  Policy details for the business process definition. This report helps you quickly find security groups and/or workers that have access to perform actions on a business process that they shouldn’t.   -  Including groups and workers for:  - Initiating  - Approving - Contributing - Cancelling - Rescinding - Correcting - Reassigning - Viewing ![A screenshot of a computer Description automatically generated](https://blog.invisors.com/hs-fs/hubfs/undefined-1.png?width=1600&height=442&name=undefined-1.png)   Custom View Security Groups:  Upgrade the delivered View Security Groups report to include all data pertaining to a security group. Including but not limited to assignable roles and assignees, BP access, and member details.  Organization Roles by Assignment Type:  View all assigned, inherited, defaulted role assignments for the organization (including subordinate organizations) selected in the prompt.  Role Assignments Changed within Time Range:  Recent role assignment changes. Helpful when a user is wondering why visibility to a population has changed.  Let us help you curate your Security Audit Dashboard today and have this analysis at your fingertips!  [![Contact an expert](https://no-cache.hubspot.com/cta/default/8290310/65c901a2-9ec7-4132-a68f-bee00a392db0.png)](https://cta-redirect.hubspot.com/cta/redirect/8290310/65c901a2-9ec7-4132-a68f-bee00a392db0) #### Contact an expert ##### About the Author ![Kelly Bradley, Area Manager](https://blog.invisors.com/hubfs/Kelly%20Bradley.png) ###### Kelly Bradley, Area Manager Kelly joined Invisors in 2020 and serves as an Area Manager on the Solution Delivery team. She has helped guide teams through Workday implementations with a primary focus in Adv Comp, HCM, Security and Analytics, bringing structure and clarity to projects from kickoff through go live. ## Resources ![Blog Category](https://blog.invisors.com/hubfs/Resources%20Icons/Blog_Category.jpg) Blog 6 Wishes Granted Thanks to Workday Financial Management ➔ ![Blog Category](https://blog.invisors.com/hubfs/Resources%20Icons/Blog_Category.jpg) Blog 6 Wishes Granted Thanks to Workday Financial Management ➔ ## More Workday Resources: [![Video Testimonial](https://blog.invisors.com/hubfs/Resources%20Icons/Video%20Testemonial.png)](https://resources.invisors.com/empower-with-information-series) [Video Testimonial](https://resources.invisors.com/empower-with-information-series) [Demand + Capacity with Workday Prism Analytics](https://resources.invisors.com/empower-with-information-series) [![customer_story](https://blog.invisors.com/hubfs/Icons/Case%20Study.jpg)](https://www.invisors.com/_files/ugd/aaa432_9a38ddd2ec784630b771ba37a01fd5fb.pdf) [Customer Story](https://www.invisors.com/_files/ugd/aaa432_9a38ddd2ec784630b771ba37a01fd5fb.pdf) [Putting Your Data to Work with Prism Analytics](https://www.invisors.com/_files/ugd/aaa432_9a38ddd2ec784630b771ba37a01fd5fb.pdf) ![On Demand Webinar](https://blog.invisors.com/hubfs/Ondemand%20Webinar.png) On-Demand Webinar Analytics Webinar Place Holder Invisors Blog Blog 6 Wishes Granted Thanks to Workday Financial Management Invisors Blog Blog 6 Wishes Granted Thanks to Workday Financial Management Invisors Blog Blog 6 Wishes Granted Thanks to Workday Financial Management ![2-Blog-Icon](https://blog.invisors.com/hubfs/Resources%20Icons/2-Blog-Icon.png) ## Workday Security Groups: Choosing the Right Model for Your Growing Business Looking to optimize your security model? As your business grows and evolves, your security needs do too. With so many Workday security group types, choosing the right one can be daunting, especially in a tenant that has been live for some time. To help you make these difficult decisions, our Workday security experts have prepared an overview of some frequently used security group types and key considerations you can take into account to guide your choice. [Read the blog](https://blog.invisors.com/blog/workday-security-groups-choosing-the-right-model-for-your-growing-business) Ready to build a new home for your business? Contact a Workday expert! #### Contact a Workday Expert ![Invisors_footer_Logo](https://blog.invisors.com/hs-fs/hubfs/Invisors_footer_Logo.png?width=606&name=Invisors_footer_Logo.png "Invisors_footer_Logo") Elevating Perspective + Transforming Results A global consultancy + a Workday Certified Services Partner. Growing because we have happy customers + seasoned Workday consultants. Executing immediate Workday needs + enabling long-term operational success. #### Services - [AI Workday Services](https://www.invisors.com/workday-ai) - [Workday Financial Management](https://www.invisors.com/workday-financial-management) - [Workday Human Capital Management](https://www.invisors.com/workday-human-capital-management) - [Workday Adaptive Planning](https://www.invisors.com/workday-adaptive-planning) - [Workday Analytics](https://www.invisors.com/workday-analytics-deployment) - [Workday Support](https://www.invisors.com/workday-support) - [Workday Extend + Built on Workday](https://www.invisors.com/workday-extend) - [Workday Change Management](https://www.invisors.com/workday-change-management) #### Company - [Overview](https://www.invisors.com/company-overview) - [Methodology](https://www.invisors.com/methodology) - [Careers](https://www.invisors.com/careers) - [Open Positions](https://invisors.wd503.myworkdayjobs.com/en-US/External/) - [Community](https://www.invisors.com/community) - [Events](https://www.invisors.com/events) - [Customers](https://www.invisors.com/customers) #### Resources - [Not Yet on Workday](https://www.invisors.com/not-yet-on-workday-tools) - [Already Live on Workday](https://www.invisors.com/live-on-workday-tools) #### Contact & Follow [+1.678.270.2717](tel:+1.678.270.2717) [info@invisors.com](mailto:info@invisors.com) Subscribe - - - [![icons8-twitterx](https://blog.invisors.com/hubfs/icons8-twitterx.svg)](https://twitter.com/invisors) - - © Invisors LLC. All Rights Reserved. 1201 Peachtree Street NE Suite 1500, Atlanta, GA 30361 [Privacy Policy](https://www.invisors.com/privacy-shield)           [Cookie Policy](https://www.invisors.com/cookie-policy) [Accessibility Statement](https://www.invisors.com/accessibility) [Slavery and Human Trafficking Statement](https://www.invisors.com/slavery-and-human-trafficking-statement) [Aetna Machine Readable Files (MRFs)](https://health1.aetna.com/app/public/#/one/insurerCode=AETNACVS_I&brandCode=ALICSI/machine-readable-transparency-in-coverage?searchTerm=99018150&lock=true) [![wday-partners-logo-partner-2](https://blog.invisors.com/hubfs/wday-partners-logo-partner-2.svg "wday-partners-logo-partner-2")](https://marketplace.workday.com/en-US/pages/partner-profile?vendor=80e86a27-cc4e-45d5-888b-b1faa4f25f33&tab=overview) [![System and Organization Controls SOC Suite of Services](https://blog.invisors.com/hs-fs/hubfs/System%20and%20Organization%20Controls%20SOC%20Suite%20of%20Services.webp?width=90&name=System%20and%20Organization%20Controls%20SOC%20Suite%20of%20Services.webp "System and Organization Controls SOC Suite of Services")](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) All of the beautiful artwork on our website is done by the gifted [Katie Reim](https://www.katiereim.com/home) Theme Design By [Awwal Design](https://awwaldesign.com/) ![BlackLogo-1](https://blog.invisors.com/hs-fs/hubfs/Logos/BlackLogo-1.png?width=159&name=BlackLogo-1.png "BlackLogo-1") ###### Stay up to date #### Receive the latest news, events, and Workday resources right to your inbox.