The Complete Guide to Workday Tenant Health
Workday tenants don't fail loudly. They drift. Security groups multiply. Integrations fall behind without an alert subscriber. Calculated fields silently return the wrong value for months. This is the complete guide to what tenant health actually means, why it matters for SOX §404 and GDPR Art. 5, and how to find and fix every category of issue before your next audit.
1. What 'tenant health' actually means in Workday
Workday is built on an object-oriented data model, not a relational database. There are no tables to query — every worker, position, security group, business process, and integration is an object with attributes and relationships. Auditors who came from SQL environments struggle with this because there is nothing to SELECT FROM.
Tenant health is the aggregate state of those object relationships. Are security groups scoped to the right organisation? Are business process definitions still routing to active workers? Are integrations running on schedule and writing to systems that still exist? Are calculated fields returning valid output instead of error rows that get silently dropped from reports?
When those relationships degrade, the tenant continues to function on the surface. Payroll runs. Reports generate. Employees log in. Underneath, the system is producing incorrect data, exposing PII it should not, or routing approvals to people who left the company two years ago.
2. The six scan categories
Yoetz.ai groups every Workday tenant finding into one of six categories. The same six categories appear in every Big 4 audit scoping document — they just take 8 weeks to walk through manually.
- Security Groups — misconfigured permissions, unconstrained groups, ISU over-access, role/user-based group sprawl.
- Business Processes — stuck transactions, broken approval chains, zombie processes referencing terminated workers.
- Integrations — failing runs, personal-account ISUs, missing alert subscribers, deprecated field mappings.
- Calculated Fields — critical errors, deprecated object references, performance hotspots that throttle reports.
- AI Readiness — Workday Illuminate compatibility, Joule activation blockers, Oracle AI Agent prerequisites, data-quality gaps.
- Release Readiness — pre-R1/R2 audit, deprecated object detection, regression risk scoring across the entire object graph.
3. The compounding problem of releases
Workday releases R1 in March and R2 in September every year. Each release deprecates objects, renames fields, and changes default behaviour for security groups and business processes. There is no static tenant — every six months the foundation moves under you.
Without a pre-release audit, every update weekend is a risk event. In our scan data, the average enterprise tenant accumulates three to five undetected regressions per release cycle. Most of them surface six to eight weeks later as a payroll exception, a failed integration, or a calculated field that has been multiplying the wrong column since R2 went live.
4. The cost of ignoring it
ISU over-access is the #1 finding in every SOX §404 ITGC audit of a Workday environment. A single unconstrained security group on a compensation domain creates a GDPR Art. 5 data minimisation violation that can affect every worker record in the tenant. A failed integration with no alert subscriber silently breaks downstream payroll data for six weeks before anyone notices — usually after the auditor asks for evidence.
These are not edge cases. In aggregate scan data across enterprise tenants, 74% have at least one Critical security group misconfiguration, 89% have at least one ISU with broader domain access than the integration requires, and 68% have a failing or overdue integration with no alert subscriber.
5. The gap in Workday's own tooling
Workday's R1 2025 release added a Security History for Users Audit report (noted publicly by PwC in February 2025). It tracks changes to user-based security groups only. It does not cover role-based security groups, Integration System Security Groups (ISSGs), or domain security policy changes. In most tenants, role-based groups govern the vast majority of worker data access — so the report covers the smallest surface and leaves the largest one invisible.
6. Yoetz.ai vs. Big 4 vs. Pathlock vs. SailPoint
Yoetz.ai covers all six categories above in a single 2-hour scan, with verified fix steps, effort estimates, owner assignments, and compliance mapping. Big 4 engagements cover 1–2 categories deeply over 6–8 weeks for $150K–$600K. Pathlock and SailPoint focus on access governance only — they do not scan business processes, calculated fields, AI readiness, or release risk.
- Calculated field coverage: Yoetz ✓, Big 4 partial, Pathlock ✗, SailPoint ✗
- Release readiness assessment: Yoetz ✓, Big 4 ✗ (not in standard SOW), Pathlock ✗, SailPoint ✗
- AI readiness scoring: Yoetz ✓, others ✗
- Rescan after remediation: Yoetz ✓ (2 hours), Big 4 = a second engagement
- White-label for consulting firms: Yoetz ✓, others ✗
Tenant health as a leading indicator, not a lagging one
Most organisations only measure tenant health reactively — after a payroll error, a failed audit, or a botched release weekend forces attention onto the underlying configuration. This is the equivalent of only checking a car's brakes after they've already failed. Tenant health, measured properly, is a leading indicator: security group sprawl, integration error rates, and calculated field regression counts all trend upward for months before they produce a visible incident.
Organisations that track these metrics continuously, rather than assessing them only during a scheduled audit, can intervene while the cost of fixing an issue is still low — a security group with growing membership can be reviewed and split before it becomes an SoD conflict investigated by an external auditor; a calculated field with a rising error rate can be fixed before it corrupts a payroll run. The entire economic case for continuous tenant health monitoring rests on this asymmetry: the cost of prevention scales linearly with tenant complexity, while the cost of a reactive incident scales with how long the underlying issue went undetected.
How to set internal tenant health KPIs your leadership will actually track
- Critical and High severity findings open, trended quarter over quarter — the single most useful number for a steering committee, because the trend line matters more than the absolute count.
- Mean time to remediation (MTTR) for Critical findings, separated from High/Medium — a rising MTTR on Critical items is an early signal of under-resourcing before it becomes an audit finding.
- Percentage of security groups reviewed in the last 12 months — a proxy for whether the recurring governance cadence is actually happening or has quietly lapsed.
- Integration failure rate and percentage with a configured alert subscriber — silent integration failures are consistently the most common source of downstream data corruption.
- AI readiness score trend, if the organisation has an active or planned Illuminate/Joule/Oracle AI Agent initiative, since this score directly gates the ROI of any AI investment.
Tenant health and the annual budgeting cycle
Tenant health work competes for budget against visible, business-facing HR technology initiatives — a new performance management module, a talent marketplace rollout, an engagement survey platform. Tenant health work is invisible when done well and catastrophic when neglected, which makes it structurally difficult to secure proactive budget for, because there's no demo to show a steering committee and no employee-facing feature to point to.
The most successful internal advocates for tenant health budget reframe the conversation away from 'maintenance' and toward risk quantification: translating scan findings into an estimated cost of a plausible incident (a SOX audit finding requiring remediation under auditor scrutiny typically costs materially more to fix under deadline pressure than the same finding fixed proactively) and comparing that to the modest annual cost of continuous scanning and a disciplined remediation cadence. This reframes tenant health from a cost centre into a risk-transfer decision, which budgeting committees are generally better equipped to evaluate.
The relationship between tenant health and employee trust
Tenant health has a dimension that rarely appears in technical documentation but matters enormously in practice: employee trust in the HR system. When a compensation change is delayed by a broken business process, when a benefits election doesn't sync correctly because of a failing integration, or when an employee discovers they can see compensation data for people outside their reporting line because of an unconstrained security group, the damage isn't purely technical — it erodes confidence in HR as a function.
This matters for HRIS teams making the case for tenant health investment to non-technical stakeholders in HR leadership, who may not find a SOX control gap persuasive but will immediately understand the reputational cost of a data exposure incident that employees notice and discuss with each other.
Multi-tenant health: managing Preview, Sandbox and Implementation tenants alongside Production
Organisations running active projects typically maintain several non-production tenants alongside Production — a Sandbox Preview tenant refreshed before every release, an Implementation tenant for an in-flight project, and sometimes a dedicated Sandbox for integration testing. Each of these tenants can independently accumulate its own configuration drift, and issues discovered only in Production are, by definition, discovered too late.
A disciplined tenant health practice extends scanning to every non-production tenant on the same cadence as Production, particularly Sandbox Preview in the two weeks before each R1/R2 release, since this is precisely the window where release-related regressions should be caught before they reach Production. Organisations that scan Production alone, while treating non-production tenants as lower priority, consistently discover that regressions found 'for the first time' during a release weekend had actually been visible in Preview for weeks — simply not looked for.
Communicating tenant health findings to non-technical HR leadership
A scan report full of security group IDs, domain security policy names and calculated field object references is unusable in a conversation with a CHRO. The most effective HRIS teams maintain two versions of every tenant health report: the full technical detail for the remediation team, and an executive summary translating findings into business risk language — 'X employees currently have visibility into compensation data outside their reporting line' rather than 'Security Group SG-4471 has unconstrained Get access to the Compensation domain.'
This translation work is often the single highest-leverage activity an HRIS leader can do with scan output, because it's what actually secures ongoing executive sponsorship for the remediation work, budget for tooling, and headcount for the team doing the fixing.
Frequently asked questions
Will it modify anything in our tenant?
No. Yoetz.ai uses read-only API access exclusively. The integration system user we ask you to create has SELECT-equivalent permissions on the domains we scan and nothing else.
Does it work in Workday Preview/sandbox?
Yes. We recommend the first scan in Preview during the week before each R1/R2 update so you have a clean baseline to compare against post-update.
How does it handle custom security groups?
We enumerate every security group regardless of provenance, classify role-based / user-based / ISSG, and check each for unconstrained domain access, overlap with other groups, and orphaned membership.
What if we have Workday Financial Management too?
The scan extends to Financial Management security groups, business processes, and integrations using the same connector. There is no separate engagement.
Does it check Workday Extend configurations?
Yes. Extend apps, their security policies, and their domain bindings are part of the AI Readiness and Security categories.
How long does a rescan take after remediation?
Under 2 hours for an enterprise tenant. The scan is fully automated end to end.
Can we use it for our SOX evidence package?
Yes. The report exports to a formatted evidence package mapped to the 12 ITGC controls auditors test in every Workday review.
What credentials do we need to create?
One Integration System User with read-only access to the security, HCM, and integration domains we scan. Setup is documented and takes about 15 minutes.
How often should Production tenant health be formally reported to leadership?
Quarterly is the common cadence for a formal executive summary, aligned to the same rhythm as other risk and compliance reporting, with the underlying scan itself running more frequently (monthly or continuously) so the quarterly report always reflects current, not stale, data.
Is tenant health different for a newly implemented tenant versus one that's been live for years?
The categories of risk are the same, but a newly implemented tenant's issues tend to stem from rushed go-live configuration decisions, while a mature tenant's issues tend to stem from accumulated drift across many small changes over time. Both benefit from the same scan methodology; the remediation priorities differ.
What's a realistic timeline to go from 'never scanned' to 'clean baseline'?
For a mature enterprise tenant, expect 60–90 days to remediate the highest-severity findings from a first comprehensive scan, assuming a dedicated remediation resource. Reaching a genuinely low steady-state finding count typically takes two to three full quarterly cycles.
Does tenant health monitoring apply the same way to smaller tenants (under 1,000 employees)?
Yes, though the absolute scale of findings is smaller. Smaller organisations often have leaner teams managing security administration, which paradoxically increases certain SoD risks (fewer people to split duties across), making systematic scanning arguably even more valuable relative to team capacity.
Continue reading
Find out what's broken in your tenant
Free first scan. Read-only access. Results in under 2 hours.
Start Your Free Scan