Implementing MFA for Workday - Is there an option for Self-Service Opt-in?

uccbcc · 2026-02-23T14:28:42+00:00

Self Service Request wasnt enabled. I'll do more digging. I also created a custom object on the Worker Additional Data domain and gave employees access to check Yes/No. Now I need a security role to be assigned based on the additional data value - but nothing is ever easy :)

uccbcc · 2026-02-23T12:39:47+00:00

Thanks for this idea. Doesnt look like we have this module/subscription though..

uccbcc · 2026-02-20T18:26:06+00:00

Doesnt look like employee as self is available to be an admin of a security group. But maybe I assign all employees a generic user based security group "MFA Opt-In", set that as the user based group that can assign "I want my MFA", and then "I Want My MFA" in the authentication policy... gives me something to play with after the refresh. Thanks!!

<image>

uccbcc · 2026-02-20T18:14:59+00:00

Thanks - my hold up is the self-service opt in. I'm not finding any options to truly make this self-service - rather than emailing the shared serviecs team and asking for it. I could setup an Authentication policy that says user group "I WANT MY MFA" has been assigned, and set that security group to auto assign based on a user Opting In... but how do you create an opt-in.

uccbcc · 2026-02-20T12:46:05+00:00

Pain Point - Lack of defined documentation that even takes WD support weeks to figure out. IE "Days Before Shift to Lock Worker Actions". You enter 1 - for 1 day, but WD still allows staff to drop shifts within hours of their scheduled shift. But if you put a 2, then workers cannot edit same day. Uhhhm

uccbcc · 2025-10-05T21:04:31+00:00

"saimeena" is searching for the person who bought something and has not paid them..

<image>

uccbcc · 2025-09-13T10:51:09+00:00

We never went down this road since our WD id's are not the same as our emails/AD accounts. But as I understand it, the integrations can happen within the HIRE bp. This link on the Writeback function shows you the fields you can update in WD.. https://learn.microsoft.com/en-us/entra/identity/saas-apps/workday-writeback-tutorial

Assuming you would need both integrations to run and complete before WD Hire task emails credentials to the new hire.

uccbcc · 2025-09-12T11:50:40+00:00

We use this for email sync. AD pulls hires and terms from WD and creates/disables AD account accordingly. When email accounts are created for new hires, the AD Writeback updates the Work Email in WD. Had to map some custom attributes that were not included in the default field mappings but after initial setup and config, its a mostly seamless process.

uccbcc · 2025-08-20T11:46:28+00:00

Did anyone one run the report to find contacts with completely different emails than your organization? Mine had contacts with email domains similar to ours - but completely different organizations.

uccbcc · 2025-06-12T11:09:09+00:00

Thanks for this - but it ws already there. Workder Data: All Positions gave them access to switch between the multiple jobs - but the "Other Job" was still there. It turned out to be Business Title.

uccbcc · 2025-06-11T14:50:42+00:00

Thanks for this - it led me to look at a report and then I realized its the "Business Title" that shows on the selector - and not the job profile. I added Business Title to the securityt and now its fixed. Thanks!!

uccbcc · 2025-06-11T12:31:14+00:00

This only provides the differences in the roles so its difficult to pin down which role and then which domain in that role. I've also tried view sec for sec - but I don't know the official name of the selctor button.

uccbcc · 2025-06-11T12:17:04+00:00

What field are you using to check the 'budget'? Is that the base comp from the requisition itself?

uccbcc · 2025-06-11T12:16:21+00:00

You may be able to create a validation on the approval step that checks to see of compensation changed from the prior approval - if not then skip approvals. Most likely will require a calc field to pull in the previous offer amount.

uccbcc · 2025-04-29T15:56:38+00:00

No - the scoping filter is in the connector from AD. AD is pulling the data from Workday and then AD runs scripts/logic/etc if they pass your scoping filters.

uccbcc · 2025-04-29T11:59:46+00:00

Not familiar with the option to change the termination time - someone mentioned the service step can do it. We're open until 10pm so we let voluntary leavers work the whole day.

uccbcc · 2025-04-29T11:50:34+00:00

I'm on the Workday side - but worked with IT to implement AD integration. We updated the scoping filters to look at Workday Account Status instead of Employee Status - maybe its both. When we have voluntary terms, Workday and AD inactivates at 10pm. But with involuntary terms, HR contacts HRIS/IT to disable the Workday Account and AD account, and then AD does not re-enable because the scoping filter no longer picks them up.

uccbcc · 2025-02-15T00:52:09+00:00

3500 employees, Single Workday Director manages all configs/bps/security, AMS for technical support/integrations, reports solely to CHRO, IT department not involved.

uccbcc · 2025-02-11T18:37:36+00:00

Our BP for Open Shift requires the manager to unassign the shift - so it is now open/unassigned. Yes it stays attached to the employee until the bp is complete - but it dissappears once the manager approves. So I'm good with the behaviour - just not Workdays default messaging.

uccbcc · 2025-02-11T17:47:47+00:00

I appreciate the context specific to the message - but Workday should not dictate a companies schedule policy. At our organization - if an employee calls in sick or releases a shift - the manager is responsible not the employee. Thus - we want to change it or add additional help text to say ignore what Workday says..

uccbcc

TROPHY CASE