🌞🏗 The major Workday security upgrade you should set up ASAP

Read time: 8 minutes

Hey there! Managing user-based security group assignments has been a major pain point for Workday customers for years on end…

Until now! Those days are finally behind us—if you implement the new functionality 😏

In today’s newsletter, I’m sharing a step-by-step guide to help you successfully upgrade your security setup.

With 2024R1 and 2024R2, Workday released two new business processes that replace the old, non-workflow-enabled tasks for assigning user-based security groups. With these business processes, we say goodbye to…

👎 Lack of approvals and process visibility
👎 Compliance risks / SOC concerns galore
👎 Lousy delivered and custom reporting

The User-Based Security Group Event for User business process replaces the “Assign User-Based Security Groups for Person” task for assigning / removing multiple user-based security groups for a user (2024R1).

And the User-Based Security Group Event for Group business process replaces the “Assign Users to User-Based Security Group” task for assigning / removing multiple users from a single user-based security group (2024R2).

Without further ado, grab your coffee or tea, and let’s get this party started! 💃🏻

Step 1: Plan your project—the well built way!

The best way to ensure your Workday initiatives are successful, no matter how mini or massive the undertaking, is to structure your work as projects. Whether you’re rolling out a new module or simply deploying a new business process, a ✨ project structure ✨ inspires accountability, organization, and execution.

So before we dive into configuring your security upgrade, let’s set you up for success! The more thought you put into this step, the better your deployment will be.

You can think of this implementation as a mini project. Here are your phases and steps:

• Plan:

  • Step 1: Project planning: Team, timeline, requirement gathering

• Configure:

  • Step 2: Enable the new domain, “Process: User-Based Security Group Event”

  • Step 3: Create your new business processes

  • Step 4: Configure your business process security policies

  • Step 5: Configure your business process definitions

  • Step 6: Set up custom business process notifications (if you want!)

  • Step 7: Disable the old functionality

• Test:

  • Step 8: Test!

• Document and empower:

  • Step 9: Document your new setup and educate your team

• Deploy:

  • Step 10: Go live in PROD 🏁

For this mini project, you can split planning into 3 steps…

1. Build your team - who is responsible for each step of this project?

2. Establish a project timeline - how long do you expect each project phase to take? Here’s a high-level 6-week sample timeline. You can tighten or extend this to match your team’s pace and bandwidth…

   • Plan (2 weeks)

   • Configure (1 week)

   • Test (1 week)

   • Document and empower (1 week)

   • Deploy (1 week)

3. Requirement gathering: What information do you need to implement this upgrade? Focus on…

   1. BP definition workflows - what steps, actions, and/or approvals should kick off in Workday when a user-based security group assignment or removal is initiated for a) one user for one or more groups and b) one group for one or more user? Map these workflows in detail.

   2. BP security policies - who / which security groups will have which business process access? Consider all permissions on each BP security policy. Here are a few heavy hitters…

      • Initiate, Review, View All (Needed to view the event data for reporting), Approve, Cancel, Deny

   3. Custom notifications - do you need to notify workers, security groups, and/or third parties with specific information when a user-based security group assignment or removal is completed?

   4. Change management - who needs to be trained on this upgrade? How will you inform, educate, and empower them?

Alright! 💪 That was no easy feat—but getting the details right from the get-go is a winning strategy (and we want you to win!). With this preparation complete, you’re ready to cruise through the rest of this mini project 😎 So let’s get to it…

Step 2: Enable the new domain, “Process: User-Based Security Group Event” 

1. Navigate to the domain, “Process: User-Based Security Group Event”. Your quickest way there is to use the prefix “domain:” in the search bar.

2. Click the related action button next to “Domain Security Policy”, hover over “Domain Security Policy,” and click “Enable”. Check the “Confirm” box and press OK.

3. This domain automatically inherits its parent domain’s permissions (Security Administration). I recommend leaving these settings in place, but here’s how to edit the permissions more granularly:

   • Click on the related action button on the domain, hover over “Domain Security Policy”, and click “Edit Permissions”. Update the View, Modify, Get, and Put permissions as desired, then click OK.

4. Activation time! 💥 A critical step to never forget. Navigate to the task, “Activate Pending Security Policy Changes”, leave a detailed comment, and press OK.

Your domain will now have a Status of “Active” 🎉

Step 3: Create your new business processes

There are two new business processes you’ll need to create:

1. User-Based Security Group Event for User

2. User-Based Security Group Event for Group

In this guide, we’ll walk through setting up the User-Based Security Group Event for User BP. You can then follow the same steps to set up the User-Based Security Group Event for Group BP on your own.

1. Use the task, “Create Business Process Definition (Default Definition)”, to create your new business process definition.

2. On your next screen titled “Edit Business Process”, simply press OK. Before you can configure steps on the business process, you’ll need to set up the Business Process Security Policy…

Step 4: Configure your business process security policies

1. Click on the related actions button on the business process, hover over “Business Process Policy”, and click “Edit”.

2. Configure the permissions on the business process security policy at your organization’s discretion (as you planned in Step 1!). To keep things simple, I recommend leveraging the Security Administrator and/or HR Administrator security groups.

3. Activation time, once more! Navigate to the task, “Activate Pending Security Policy Changes”, leave a solid comment, and press OK.

Step 5: Configure your business process definitions

Now for the fun part—where the magic of this upgrade happens! 🪄 Let’s set up the business process steps.

1. Navigate back to the business process, click on the related actions button, hover over “Business Process”, and click “Edit Definition”.

2. Add your business process steps per your organization’s defined policy. Click the “+” button to add rows. The permissions you set up in Step 4 on the BP security policy determine which steps you can assign to which security groups.

3. Don’t forget to set your completion step, typically the last approval in your definition.

4. Other setup steps to consider here are…

   • Advanced Routing - for example, exclude initiators from approving their own assignments.

   • Business Process Validations - are there situations in which initiation should be blocked, or slowed with a warning?

   • Business Process Conditions - should certain steps be skipped if specified conditions are or are not met?

Step 6: Set up custom business process notifications (if you want!)

This step is totally optional! To add custom notifications, click on the related actions button on the business process, hover over “Business Process”, and click “Add Notification”.

Step 7: Disable the old functionality

Now that you’ve got the new functionality in place, there’s no reason to keep the legacy tasks in play (unless you want to make a big ole’ mess out of your audit trails 😵‍💫).

Here’s how to disable the old tasks once and for all…

Navigate to the task, “Maintain Feature Opt-Ins”, find the “Disable User-Based Security Group Assignment Task” item (filter the column to be speedy!), and click the “Opt In to Feature” button:

By disabling the existing tasks, all user-based security group assignment changes will go through the new business process. To confirm you’ve successfully disabled the tasks, check the related actions on a user-based security group. Only one initiation option should remain, “Update Membership”:

Workday hasn’t specified a deprecation date yet, however, the non-workflow-enabled tasks will be deprecated down the road. Since you are proactively implementing the new functionality, you won’t be scrambling when that day comes 😎

Step 8: Test!

Use the Update User-Based Security Group Assignments initiating task to test the “User-Based Security Group Event for User” BP.

And use the Update User-Based Security Group Membership initiating task to test the “User-Based Security Group Event for Group” BP.

Test plentiful scenarios! Ensure every piece of configuration you set up is put to the test, including routing rules, BP validations, BP conditions, custom notifications, etc.

Step 9: Document your new setup, and educate your team

This is a crucial step that is so often forgotten or skipped. Before you go live in PROD, document your configuration and train your team on your new processes and policies. Ahead of going live, your team should feel empowered to utilize and own your upgraded setup.

At this stage, for our clients, we typically deliver…

✅ User guides with clear screenshots (kind of like what you’re reading right now 😜).

✅ Custom demo videos using our favorite recording software, Tella.

✅ Live training sessions with key stakeholders and end users (we record these so they can be rewatched!).

Step 10: Go live in PROD 🏁

It’s that time! 🥳 Complete the following setup steps manually in Production:

• Step 2: Enable the new domain, “Process: User-Based Security Group Event”

• Step 3: Create your new business processes

• Step 4: Configure your business process security policies

• Step 7: Disable the old functionality

For maximum efficiency, migrate your business process definitions (the following steps) using Object Transporter:

• Step 5: Configure your business process definition

• Step 6: Set up custom business process notifications (if you want!)

To migrate your BP (including any custom notifications), click the related action button on the BP, hover over “Instance”, and click “Migrate with Object Transporter (FYI - Workday dropped the 2.0 from OX’s name with 2024R2).

As you deploy your setup in PROD, ensure you complete your configuration steps in order.

And there you have it—your security upgrade mini project is COMPLETE!

🎉🎉🎉

As always, thank you for reading!

We’re celebrating you and your pursuit of a Well Built Workday 🥳 

Until next time!

Ceci & Mia

Co-Founders of Well Built Solutions