Failing Workday Integrations: How to Find, Fix, and Monitor Every One
The single biggest cause of Workday production incidents is a failing integration that nobody is monitoring. No alert subscriber, no notification, no incident — until payroll questions a missing data feed six weeks later. Here are the three failure modes, the orphaned-ISU problem, and a monitoring framework that actually catches these.
1. The three failure modes
- (a) The integration errors out on every run and nobody is notified — no alert subscriber on the schedule.
- (b) The integration runs but produces empty output because the ISU password expired and the web service call fails silently with an authentication error.
- (c) The integration runs successfully but maps to a deprecated field introduced in the last Workday release, producing incorrect payroll data downstream with no error logged.
2. The personal-account ISU problem
An admin created an integration ISU under their own Workday account email during implementation. When they left the company, their Workday account was deactivated. The integration ISU is now orphaned — the ISU's account is tied to a deactivated user record. This creates three simultaneous findings: a SOX access control finding (terminated employee credential active), an integration runtime finding (will fail on next credential rotation), and an offboarding control failure.
3. OAuth 2.0 vs. username/password
Best practice for 2025 is OAuth 2.0 for all Workday API integrations. Username/password ISU credentials require manual rotation — easy to forget, easy to miss, a direct SOX finding when rotation is overdue. OAuth tokens rotate automatically. Workday supports OAuth 2.0 for API-based integrations; Studio-based integrations require a different migration path but the principle is the same.
4. Building an integration monitoring framework
Navigation: Integration → [Integration Name] → Schedule → Alert Subscribers → Add → enter email or Workday user. The list should include the integration owner (a named individual), a backup admin, and an HRIT mailbox so alerts survive personnel changes.
5. Use Workday's built-in reports
- 'View Integration System' — every integration, schedule status, last run time, last run result.
- 'Integration Audit' — full run history with error details.
- Schedule a weekly 30-minute review of these two reports as a standing HRIT process.
6. The release-readiness connection
Every Workday release can deprecate field names used in integration mappings. An integration that maps to 'emplid' in one release may need 'worker_id' in the next. Run a pre-release scan against your integration mappings before every R1 and R2.
Continue reading
Find out what's broken in your tenant
Free first scan. Read-only access. Results in under 2 hours.
Start Your Free Scan