You have successfully configured an ISU and an ISSG with the correct security policies and have assigned them to an EIB.
What task do you need to run before you can launch the EIB?
Activate Pending Security Policy Changes
View Security for Securable Item
Assign the ISSG to only one security policy
Maintain Integration Security Policies
In Workday, after configuring an Integration System User (ISU) and an Integration System Security Group (ISSG) with the appropriate security policies and assigning them to an Enterprise Interface Builder (EIB) integration, there is a critical step required before the EIB can be launched successfully. This step ensures that all security configurations and permissions assigned to the ISSG take effect in the Workday tenant. Let’s analyze the question and evaluate each option systematically to determine the correct task, ensuring the answer aligns with Workday’s documented processes and the Workday Pro Integrations Study Guide.
Context of the Scenario
You’ve completed the following:
Created an ISU and configured it (e.g., with "Do Not Allow UI Sessions" checked for web service-only access).
Set up an ISSG and assigned the ISU to it.
Defined the necessary security policies (e.g., domain security policies with "Get" and/or "Put" access) for the ISSG to support the EIB’s operations.
Assigned the ISU and ISSG to the EIB integration system.
The question now is what must be done before launching the EIB to ensure it functions as intended. In Workday, changes to security policies—such as adding permissions to an ISSG—do not take effect immediately. They remain in a "pending" state until activated, which is a key aspect of Workday’s security administration process.
Evaluation of Options
Option A: Activate Pending Security Policy ChangesIn Workday, whenever you modify security policies (e.g., granting domain permissions like "Integration Build" or "Custom Report Creation" to an ISSG), these changes are staged as "pending." To apply them to the tenant and make them active, you must run the "Activate Pending Security Policy Changes" task. This task reviews all pending security updates, allows you to add a comment for audit purposes, and, upon confirmation, activates the changes. Without this step, the ISSG will not have the effective permissions required for the EIB to access data or execute its operations, potentially causing the launch to fail due to insufficient authorization. This aligns directly with the scenario, as security policies have been configured and assigned, but not yet activated.
Option B: View Security for Securable ItemThe "View Security for Securable Item" report is a diagnostic tool in Workday that allows you to inspect the security configuration for a specific object (e.g., a web service operation, report, or task). It shows which security groups have access and what permissions (e.g., "Get," "Put," "View," "Modify") are granted. While this is useful for verifying that the ISSG has the correct policies assigned, it is a passive report—it does not modify or activate anything. Running this task would not enable the EIB to launch, as it doesn’t affect the pending security changes. Thus, it’s not the required step before launching the EIB.
Option C: Assign the ISSG to only one security policyThis option suggests limiting the ISSG to a single security policy, but this is neither a standard Workday requirement nor a task that exists as a standalone action. ISSGs can and often do havemultiple security policies assigned (e.g., permissions for various domains like "Integration Build," "Custom Report Access," etc.), depending on the integration’s needs. Moreover, the question states that the ISSG has already been configured with the "correct security policies" and assigned to the EIB, implying this step is complete. Restricting the ISSG to one policy after the fact would require editing permissions again, triggering more pending changes, and still necessitate activation—making this option illogical and incorrect.
Option D: Maintain Integration Security PoliciesThere is no specific task in Workday called "Maintain Integration Security Policies." This option seems to be a misnomer or a conflation of other tasks, such as "Maintain Domain Permissions for Security Group" (used to assign permissions to an ISSG) or broader security maintenance activities. However, the question indicates that the security policies are already correctly configured and assigned. If this option intended to imply further configuration, it would still result in pending changes requiring activation via Option A. As a standalone action, it does not represent a valid or necessary task to enable the EIB launch.
Why Option A is Correct
The "Activate Pending Security Policy Changes" task is a mandatory step in Workday’s security workflow after modifying security policies, such as those assigned to an ISSG for an EIB. Workday’s security model uses a pending changes queue to ensure that updates are reviewed and deliberately applied, maintaining control and auditability. Without activating these changes:
The ISSG will lack the effective permissions needed for the EIB to access required domains or perform its operations (e.g., retrieving data from a custom report or delivering a file).
The EIB launch could fail with errors like "Insufficient Privileges" or "Access Denied."
Running this task ensures that the security configuration is live, allowing the ISU (via the ISSG) to authenticate and execute the EIB successfully. This is a standard practice in Workday integration setup, as emphasized in the Workday Pro Integrations curriculum.
Practical Steps to Perform Option A
Log into the Workday tenant with a security administrator role.
Search for and select the "Activate Pending Security Policy Changes" task.
Review the list of pending changes (e.g., new permissions added to the ISSG).
Enter a comment (e.g., "Activating security for EIB launch – ISSG permissions").
Check the "Confirm" box and click "OK" to activate the changes.
Once completed, the security policies are live, and the EIB can be launched.
Verification with Workday Documentation
The Workday Pro Integrations Study Guide and related training materials confirm that activating pending security policy changes is a prerequisite after configuring security for integrations. This step ensures that all permissions are in effect, enabling the ISU and ISSG to support the EIB’s functionality. Community resources and implementation guides also consistently highlight this task as the final step before launching integrations that rely on updated security settings.
Workday Pro Integrations Study Guide References
Section: Integration Security Configuration– Explains the process of assigning security policies to ISSGs and the need to activate changes to operationalize them.
Section: Enterprise Interface Builder (EIB)– Notes that security updates for EIBs must be activated before launching to ensure proper access.
Section: Security Administration– Details the "Activate Pending Security Policy Changes" task as the mechanism to apply pending security modifications across the tenant.
Your manager has asked for a value on their dashboard for how many days away the birthdays are of their direct reports. The format of the output should be [Worker's Name]'s birthday is in [X] days, where you must calculate the number of days until a Worker's next birthday. An example output is "Logan McNeil's birthday is in 103 days."
Which calculated field functions do you need to accomplish this?
Format Date, Increment or Decrement Date, Extract Single Instance, Format Text
Build Date, Format Date, Extract Single Instance, Format Text
Date Difference, Format Number, Text Constant, Concatenate Text
Increment or Decrement Date, Format Number, Text Constant, Concatenate Text
The requirement is to create a calculated field for a dashboard that displays a worker’s name and the number of days until their next birthday in the format "[Worker's Name]'s birthday is in [X] days" (e.g., "Logan McNeil's birthday is in 103 days"). This involves calculating the difference between today’s date and the worker’s next birthday, then formatting the output as a text string. Let’s break down the necessary functions:
Date Difference:To calculate the number of days until the worker’s next birthday, you need to determine the difference between the current date and the worker’s birthdate in the current or next year (whichever is upcoming). The Date Difference function calculates the number of days between two dates. In this case:
Use the worker’s "Date of Birth" field (from the Worker business object).
Adjust the year of the birthdate to the current year or next year (if the birthday has already passed this year) using additional logic.
Calculate the difference from today’s date to this adjusted birthday date. For example, if today is February 21, 2025, and Logan’s birthday is June 4 (adjusted to June 4, 2025), Date Difference returns 103 days.
Format Number:The result of Date Difference is a numeric value (e.g., 103). To ensure it displays cleanly in the output string (without decimals or unnecessary formatting), Format Number can be used to convert it to a simple integer string (e.g., "103").
Text Constant:To build the output string, static text like "’s birthday is in " and " days" is needed. The Text Constant function provides fixed text values to include in the final concatenated result.
Concatenate Text:The final step is to combine the worker’s name (e.g., "Logan McNeil"), the static text, and the calculated days into one string. Concatenate Text merges multiple text values into a single output, such as "Logan McNeil" + "’s birthday is in " + "103" + " days".
Option Analysis:
A. Format Date, Increment or Decrement Date, Extract Single Instance, Format Text: Incorrect. Format Date converts dates to strings but doesn’t calculate differences. Increment or Decrement Date adjusts dates but isn’t suited for finding days until a future event. Extract Single Instance is for multi-instance fields, not relevant here. Format Text adjusts text appearance, not numeric calculations.
B. Build Date, Format Date, Extract Single Instance, Format Text: Incorrect. Build Date creates a date from components, useful for setting the next birthday, but lacks the difference calculation. Format Date and Extract Single Instance don’t apply to the core need.
C. Date Difference, Format Number, Text Constant, Concatenate Text: Correct. These functions cover calculating the days, formatting the number, adding static text, and building the final string.
D. Increment or Decrement Date, Format Number, Text Constant, Concatenate Text: Incorrect. Increment or Decrement Date can’t directly calculate days to a future birthday without additional complexity; Date Difference is more appropriate.
Implementation:
UseDate Differenceto calculate days from today to the next birthday (adjusting the year dynamically with additional logic if needed).
ApplyFormat Numberto ensure the result is a clean integer.
UseText Constantfor static text ("’s birthday is in " and " days").
UseConcatenate Textto combine Worker Name, static text, and the formatted number.
References from Workday Pro Integrations Study Guide:
Workday Calculated Fields: Section on "Date Functions" explains Date Difference for calculating time spans.
Report Writer Fundamentals: Covers Concatenate Text and Text Constant for string building in reports.
Refer to the following XML and example transformed output to answer the question below.
Example transformed wd:Report_Entry output;
What is the XSLT syntax tor a template that matches onwd: Educationj3roup to produce the degree data in the above Transformed_Record example?
In Workday integrations, XSLT is used to transform XML data, such as the output from a web service-enabled report or EIB, into a desired format for third-party systems. In this scenario, you need to create an XSLT template that matches the wd:Education_Group element in the provided XML and transforms it to produce the degree data in the format shown in the Transformed_Record example. The goal is to output each degree (e.g., "California University MBA" and "Georgetown University B.S.") as a
Here’s why option A is correct:
Template Matching: The
Transformation Logic:
This approach ensures that each wd:Education_Group is transformed into a single
Context and Output: The template operates on each wd:Education_Group, producing the nested structure shown in the Transformed_Record (e.g.,
Why not the other options?
B.
xml
WrapCopy
This uses
C.
xml
WrapCopy
This uses
D.
xml
WrapCopy
This uses
To implement this in XSLT for a Workday integration:
Use the template from option A to match wd:Education_Group, apply
References:
Workday Pro Integrations Study Guide: Section on "XSLT Transformations for Workday Integrations" – Details the use of
Workday EIB and Web Services Guide: Chapter on "XML and XSLT for Report Data" – Explains the structure of Workday XML (e.g., wd:Education_Group, wd:Education, wd:Degree) and how to use XSLT to transform education data into a flattened format.
Workday Reporting and Analytics Guide: Section on "Web Service-Enabled Reports" – Covers integrating report outputs with XSLT for transformations, including examples of concatenating and restructuring data for third-party systems.
What is the limitation when assigning ISUs to integration systems?
An ISU can be assigned to five integration systems.
An ISU can be assigned to an unlimited number of integration systems.
An ISU can be assigned to only one integration system.
An ISU can only be assigned to an ISSG and not an integration system.
This question examines the limitations on assigning Integration System Users (ISUs) to integration systems in Workday Pro Integrations. Let’s analyze the relationship and evaluate each option to determine the correct answer.
Understanding ISUs and Integration Systems in Workday
Integration System User (ISU):An ISU is a specialized user account in Workday designed for integrations, functioning as a service account to authenticate and execute integration processes. ISUs are created using the "Create Integration System User" task and are typically configured with settings like disabling UI sessions and setting long session timeouts (e.g., 0 minutes) toprevent expiration during automated processes. ISUs are not human users but are instead programmatic accounts used for API calls, EIBs, Core Connectors, or other integration mechanisms.
Integration Systems:In Workday, an "integration system" refers to the configuration or setup of an integration, such as an External Integration Business (EIB), Core Connector, or custom integration via web services. Integration systems are defined to handle data exchange between Workday and external systems, and they require authentication, often via an ISU, to execute tasks like data retrieval, transformation, or posting.
Assigning ISUs to Integration Systems:ISUs are used to authenticate and authorize integration systems to interact with Workday. When configuring an integration system, you assign an ISU to provide the credentials needed for the integration to run. This assignment ensures that the integration can access Workday data and functionalities based on the security permissions granted to the ISU via its associated Integration System Security Group (ISSG).
Limitation on Assignment:Workday’s security model imposes restrictions to maintain control and auditability. Specifically, an ISU is designed to be tied to a single integration system to ensure clear accountability, prevent conflicts, and simplify security management. This limitation prevents an ISU from being reused across multiple unrelated integration systems, reducing the risk of unintended access or data leakage.
Evaluating Each Option
Let’s assess each option based on Workday’s integration and security practices:
Option A: An ISU can be assigned to five integration systems.
Analysis:This is incorrect. Workday does not impose a specific numerical limit like "five" for ISU assignments to integration systems. Instead, the limitation is more restrictive: an ISU is typically assigned to only one integration system to ensure focused security and accountability. Allowing an ISU to serve multiple systems could lead to confusion, overlapping permissions, or security risks, which Workday’s design avoids.
Why It Doesn’t Fit:There’s no documentation or standard practice in Workday Pro Integrations suggesting a limit of five integration systems per ISU. This option is arbitrary and inconsistent with Workday’s security model.
Option B: An ISU can be assigned to an unlimited number of integration systems.
Analysis:This is incorrect. Workday’s security best practices do not allow an ISU to be assigned to an unlimited number of integration systems. Allowing this would create security vulnerabilities, as an ISU’s permissions (via its ISSG) could be applied across multiple unrelated systems, potentially leading to unauthorized access or data conflicts. Workday enforces a one-to-one or tightly controlled relationship to maintain auditability and security.
Why It Doesn’t Fit:The principle of least privilege and clear accountability in Workday integrations requires limiting an ISU’s scope, not allowing unlimited assignments.
Option C: An ISU can be assigned to only one integration system.
Analysis:This is correct. In Workday, an ISU is typically assigned to a single integration system to ensure that its credentials and permissions are tightly scoped. This aligns with Workday’s security model, where ISUs are created for specific integration purposes (e.g., an EIB, Core Connector, or web service integration). When configuring an integration system, you specify the ISU in the integration setup (e.g., under "Integration System Attributes" or "Authentication" settings), and it is not reused across multiple systems to prevent conflicts or unintended access. This limitation ensures traceability and security, as the ISU’s actions can be audited within the context of that single integration.
Why It Fits:Workday documentation and best practices, including training materials and community forums, emphasize that ISUs are dedicated to specific integrations. For example, when creating an EIB or Core Connector, you assign an ISU, and it is not shared across other integrations unless explicitly reconfigured, which is rare and discouraged for security reasons.
Option D: An ISU can only be assigned to an ISSG and not an integration system.
Analysis:This is incorrect. While ISUs are indeed assigned to ISSGs to inherit security permissions (as established in Question 26), they are also assigned to integration systems toprovide authentication and authorization for executing integration tasks. The ISU’s role includes both: it belongs to an ISSG for permissions and is linked to an integration system for execution. Saying it can only be assigned to an ISSG and not an integration system misrepresents Workday’s design, as ISUs are explicitly configured in integration systems (e.g., EIB, Core Connector) to run processes.
Why It Doesn’t Fit:ISUs are integral to integration systems, providing credentials for API calls or data exchange. Excluding assignment to integration systems contradicts Workday’s integration framework.
Final Verification
The correct answer is Option C, as Workday limits an ISU to a single integration system to ensure security, accountability, and clarity in integration operations. This aligns with the principle of least privilege, where ISUs are scoped narrowly to avoid overexposure. For example, when setting up a Core Connector: Job Postings (as in Question 25), you assign an ISU specifically for that integration, not multiple ones, unless reconfiguring for a different purpose, which is atypical.
Supporting Documentation
The reasoning is based on Workday Pro Integrations security practices, including:
Workday Community documentation on creating and managing ISUs and integration systems.
Tutorials on configuring EIBs, Core Connectors, and web services, which show assigning ISUs to specific integrations (e.g.,Workday Advanced Studio Tutorial).
Integration security overviews from implementation partners (e.g., NetIQ, Microsoft Learn, Reco.ai) emphasizing one ISU per integration for security.
Community discussions on Reddit and Workday forums reinforcing that ISUs are tied to single integrations for auditability (r/workday on Reddit).
Refer to the following scenario to answer the question below.
You have configured a Core Connector: Worker integration, which utilizes the following basic configuration:
• Integration field attributes are configured to output the Position Title and Business Title fields from the Position Data section.
• Integration Population Eligibility uses the field Is Manager which returns true if the worker holds a manager role.
• Transaction Log service has been configured to Subscribe to specific Transaction Types: Position Edit Event.
You launch your integration with the following date launch parameters (Date format of MM/DD/YYYY):
• As of Entry Moment: 05/25/2024 12:00:00 AM
• Effective Date: 05/25/2024
• Last Successful As of Entry Moment: 05/23/2024 12:00:00 AM
• Last Successful Effective Date: 05/23/2024
To test your integration, you made a change to a worker named Jeff Gordon who is not assigned to the manager role. You perform an Edit Position on Jeff Gordon and update their business title to a new value. Jeff Gordon's worker history shows the Edit Position Event as being successfully completed with an effective date of 05/24/2024 and an Entry Moment of 05/24/2024 07:58:53 AM however Jeff Gordon does not show up in your output.
What configuration element would have to be modified for the integration to include Jeff Gordon in the output?
Transaction log subscription
Integration Population Eligibility
Date launch parameters
Integration Field Attributes
The scenario describes a Core Connector: Worker integration with specific configurations, and a test case where Jeff Gordon’s data doesn’t appear in the output despite an Edit Position event. Let’s analyze why Jeff Gordon is excluded and what needs to change:
Current Configuration:
Integration Field Attributes: Outputs Position Title and Business Title from Position Data.
Integration Population Eligibility: Filters workers where "Is Manager" = True (only managers).
Transaction Log Service: Subscribes to "Position Edit Event" transactions.
Launch Parameters:
As of Entry Moment: 05/25/2024 12:00:00 AM
Effective Date: 05/25/2024
Last Successful As of Entry Moment: 05/23/2024 12:00:00 AM
Last Successful Effective Date: 05/23/2024
Test Case:
Worker: Jeff Gordon (not a manager).
Action: Edit Position, updating Business Title.
Event Details: Effective Date 05/24/2024, Entry Moment 05/24/2024 07:58:53 AM.
Result: Jeff Gordon does not appear in the output.
Analysis:
Date Parameters: The integration captures changes between the Last Successful As of Entry Moment (05/23/2024 12:00:00 AM) and the current As of Entry Moment (05/25/2024 12:00:00 AM). Jeff’s Edit Position event (Entry Moment 05/24/2024 07:58:53 AM) falls within this range, and its Effective Date (05/24/2024) is before the integration’s Effective Date (05/25/2024), making it eligible from a date perspective.
Transaction Log: Subscribed to "Position Edit Event," which matches Jeff’s action (Edit Position), so the event type is correctly captured.
Field Attributes: Outputs Position Title and Business Title, and Jeff’s update to Business Title aligns with these fields.
Population Eligibility: Filters for "Is Manager" = True. Jeff Gordon is explicitly noted as "not assigned to the manager role," meaning "Is Manager" = False for him. This filter excludes Jeff from the population, regardless of the event or date eligibility.
Why Jeff is Excluded:TheIntegration Population Eligibilityrestriction ("Is Manager" = True) prevents Jeff Gordon from being included, as he isn’t a manager. This filter applies to the entire worker population before events or fields are considered, overriding other conditions.
Option Analysis:
A. Transaction Log Subscription: Incorrect. The subscription already includes "Position Edit Event," which matches Jeff’s action. Modifying this wouldn’t address the population filter.
B. Integration Population Eligibility: Correct. Changing this to include non-managers (e.g., removing the "Is Manager" = True filter or adjusting it to include all employees) would allow Jeff Gordon to appear in the output.
C. Date Launch Parameters: Incorrect. Jeff’s event (05/24/2024) falls within the date range, so the parameters are not the issue.
D. Integration Field Attributes: Incorrect. The attributes already include Business Title, which Jeff updated, so this configuration is irrelevant to his exclusion.
Modification Needed:Adjust theIntegration Population Eligibilityto either:
Remove the "Is Manager" = True filter to include all workers, or
Modify it to align with the scenario’s intent (e.g., "Worker Type equals Employee") if managers were an unintended restriction.
Implementation:
Edit the Core Connector: Worker integration.
Use the related actionConfigure Integration Population Eligibility.
Remove or adjust the "Is Manager" = True condition.
Relaunch the integration and verify Jeff Gordon appears in the output.
References from Workday Pro Integrations Study Guide:
Core Connectors & Document Transformation: Section on "Configuring Integration Population Eligibility" explains how eligibility filters the worker population before event processing.
Integration System Fundamentals: Details how population scoping interacts with event subscriptions and launch parameters.
Refer to the following XML to answer the question below.
Refer to the following XML to answer the question below.
You are an integration developer and need to write XSLT to transform the output of an EIB which is making a request to the Get Job Profiles web service operation. The root template of your XSLT matches on the
format-date('[D01]-[M01]-[Y0001]’, wd:Job_Profile_Data/wd:Effective_Date)
format-date (wd:Job_Profile_Data/wd:Effective_Date, '[D01]-[M01]-[Y0001]')
format-date (wd:Job_Profile_Data/wd:Effective_Date, '[M01]-[D01]-[Y0001]')
format-date('[M01]-[D01]-[Y0001]’, wd:Job_Profile_Data/wd:Effective_Date)
As an integration developer working with Workday, you are tasked with transforming the output of an Enterprise Interface Builder (EIB) that calls the Get_Job_Profiles web service operation. The XML provided shows the response from this operation, and you need to write XSLT to format the
Understanding the XML and Requirement
The provided XML snippet shows a response from the Get_Job_Profiles web service operation in Workday, formatted in SOAP XML with the Workday namespace (xmlns:wd="urn:com.workday/bsvc"). Key elements relevant to the question include:
The root element is
It contains
Within
You need to transform this date into the format "15-07-2024" (DD-MM-YYYY), where:
"15" is the day (D01 for two digits).
"07" is the month (M01 for two digits, noting the XML shows May, but the question specifies July for the output format—likely a hypothetical or test case adjustment).
"2024" is the year (Y0001 for four digits).
The format-date function in XPath 2.0 (used by Workday) formats a date value according to a picture string. The syntax is:
First parameter: The date value (e.g., wd:Job_Profile_Data/wd:Effective_Date), which must be an xs:date or convertible to one.
Second parameter: The picture string (e.g., '[D01]-[M01]-[Y0001]'), specifying the format using patterns like:
[D01] for two-digit day (01-31).
[M01] for two-digit month (01-12).
[Y0001] for four-digit year (e.g., 2024).
The question specifies that the root template matches
Analysis of Options
Let’s evaluate each option based on the format-date syntax, the XML structure, and the required output format "15-07-2024":
Option A: format-date('[D01]-[M01]-[Y0001]’, wd:Job_Profile_Data/wd:Effective_Date)
This option places the picture string ('[D01]-[M01]-[Y0001]') as the first parameter and the date value (wd:Job_Profile_Data/wd:Effective_Date) as the second. However, the format-date function requires the date value as the first parameter and the picture string as the second, per the syntax format-date($value, $picture). Reversing the parameters is incorrect and will result in an error or unexpected output, as format-date expects an xs:date? first. Thus, this option is invalid.
Option B: format-date (wd:Job_Profile_Data/wd:Effective_Date, '[D01]-[M01]-[Y0001]')
This option correctly follows the format-date syntax:
First parameter: wd:Job_Profile_Data/wd:Effective_Date, which points to the
Second parameter: '[D01]-[M01]-[Y0001]', which specifies the output format:
[D01] outputs the day as two digits (e.g., "15").
[M01] outputs the month as two digits (e.g., "05" for May, but the question requests "07" for July—assuming a test case adjustment or hypothetical transformation).
[Y0001] outputs the year as four digits (e.g., "2024").
The XPath wd:Job_Profile_Data/wd:Effective_Date is correctly nested under the
Option C: format-date (wd:Job_Profile_Data/wd:Effective_Date, '[M01]-[D01]-[Y0001]')
This option also follows the correct format-date syntax, with the date value first and the picture string second. However, the picture string '[M01]-[D01]-[Y0001]' specifies a month-day-year format:
[M01] outputs the month first (e.g., "05" for May).
[D01] outputs the day second (e.g., "15").
[Y0001] outputs the year last (e.g., "2024").
This would transform "2024-05-15" into "05-15-2024," which does not match the required "15-07-2024" (day-month-year) format. Thus, this option is incorrect for the specified output.
Option D: format-date('[M01]-[D01]-[Y0001]’, wd:Job_Profile_Data/wd:Effective_Date)
Similar to Option A, this option reverses the parameters, placing the picture string ('[M01]-[D01]-[Y0001]') first and the date value (wd:Job_Profile_Data/wd:Effective_Date) second. As explained earlier, format-date requires the date value as the first parameter, so this syntax is incorrect and will not work as intended. This option is invalid.
Why Option B is Correct
Option B correctly uses the format-date function with the proper syntax:
It places the date value (wd:Job_Profile_Data/wd:Effective_Date) as the first parameter, referencing the
It uses the picture string '[D01]-[M01]-[Y0001]' as the second parameter, which formats the date as "DD-MM-YYYY" (e.g., "15-05-2024" for the XML’s "2024-05-15," or "15-07-2024" as specified, assuming a month adjustment in the transformation logic).
The XPath is appropriate for the context, as the template matches
The question’s mention of "15-07-2024" suggests either a hypothetical adjustment (e.g., the EIB or XSLT logic modifies the month to July) or a test case variation. Since the XML shows "2024-05-15," the format-date function would output "15-05-2024" with the given picture string, but the principle of formatting day-month-year remains correct. Workday’s XSLT implementation supports such transformations, and the format-date function is well-documented for this purpose.
Practical Example in XSLT
Here’s how this might look in your XSLT:
This would process the
Verification with Workday Documentation
The Workday Pro Integrations Study Guide and SOAP API Reference (available via Workday Community) detail the use of XPath functions like format-date for transforming web service responses. The Get_Job_Profiles operation returns job profile data, including effective dates, in ISO format, and XSLT transformations are commonly used in EIBs to reformat data. The format-date function’s syntax and picture string patterns (e.g., [D01], [M01], [Y0001]) are standard in XPath 2.0, as implemented in Workday’s integration tools.
Workday Pro Integrations Study Guide References
Section: XSLT Transformations in EIBs– Describes using XSLT to transform web service responses, including date formatting with format-date.
Section: Workday Web Services– Details the Get_Job_Profiles operation and its XML output structure, including
Section: XPath Functions– Explains the syntax and usage of format-date($value, $picture), including picture string patterns like [D01], [M01], and [Y0001].
Workday Community SOAP API Reference – Provides examples of date formatting in XSLT for Workday web services.
Option B is the verified answer, as it correctly applies the format-date function to format the
You are creating an outbound connector using the Core Connector: Organization Outbound template. The vendor has provided the following requirements for how the data should appear in the output file.
The vendor would also like to change the default document retention policy of 30 days to 7 days. What tasks do you need to use to configure this in your connector?
Configure Integration Maps and Configure Integration Attributes
Configure Integration Field Overrides and Configure Integration Field Attributes
Configure Integration Field Overrides and Configure Integration Attributes
Configure Integration Maps and Configure Integration Field Attributes
When creating an outbound connector using the Workday Core Connector: Organization Outbound template, you need to configure the connector to meet specific vendor requirements, such as formatting output data and adjusting document retention policies. Let's break down the question and analyze the requirements and options based on Workday's integration framework, specifically focusing on the Core Connector and its configuration tasks.
Understanding the Requirements
Output Data Formatting:The vendor has provided a table specifying how organization types should appear in the output file (e.g., Cost Center as "CC", Pay Group as "PAY", Supervisory as "S", and any other value as "OTHER"). This indicates a need to transform or map Workday organization data into specific output values, which is typically handled by configuring how fields are processed or mapped in the integration.
Document Retention Policy Change:The vendor wants to change the default document retention policy from 30 days to 7 days. In Workday, document retention policies for integrations (e.g., files stored on SFTP or other delivery methods) are managed through integration settings, specifically attributes related to file retention or delivery options.
Analyzing Workday Core Connector: Organization Outbound
The Core Connector: Organization Outbound template is a pre-built Workday integration template used to extract organization-related data (e.g., cost centers, pay groups, supervisory organizations) and sendit to an external system. It leverages Workday's integration framework, including integration maps, field overrides, and attributes, to customize data output and behavior.
Integration Maps: Used to define how data is transformed or mapped from Workday to the output format, often involving XSLT or predefined mappings.
Integration Field Overrides: Allow you to override or customize how specific fields are displayed or formatted in the output, such as mapping "Cost Center" to "CC" as per the vendor's table.
Integration Attributes: Control broader integration settings, such as delivery methods, file formats, and retention policies (e.g., document retention duration).
Integration Field Attributes: Typically focus on specific field-level properties but are less commonly used for retention policies or broad mappings compared to the above options.
Evaluating the Vendor's Output Requirements
The table provided (Cost Center → "CC", Pay Group → "PAY", Supervisory → "S", any other value → "OTHER") suggests a need to transform or override the default output values for organization types. This is a field-level customization, best handled byIntegration Field Overrides, which allow you to specify custom values or formats for specific fields in the output.
For example, in the Core Connector, you can use Integration Field Overrides to map the Workday organization type (e.g., "Cost_Center") to the vendor's desired output ("CC"). This is a common practice for outbound integrations where external systems require specific formatting.
Evaluating the Retention Policy Change
The default document retention policy of 30 days needs to be changed to 7 days. In Workday, retention policies for integration output files (e.g., files delivered via SFTP or email) are configured as part of the integration's attributes, not field-level settings.
Integration Attributesare used to manage integration-wide settings, including delivery options, file retention periods, and other global configurations. You can specify the retention period (e.g., 7 days) in the attributes section of the Core Connector configuration.
This is distinct from field-level overrides or maps, as retention is not tied to individual data fields but to the integration's output management.
Analyzing the Options
Now, let's evaluate each option to determine which tasks are needed to meet both requirements:
A. Configure Integration Maps and Configure Integration Attributes
Integration Maps: These are used for broader data transformations or mappings, such as converting Workday XML to another format or defining complex data relationships. While they could theoretically handle the output value mappings (e.g., Cost Center → "CC"), they are typically more complex and less granular than field overrides for simple value changes.
Integration Attributes: Correct for configuring the retention policy (e.g., changing from 30 to 7 days), as attributes manage integration-wide settings like retention.
Why Not Sufficient?: Integration Maps are overkill for simple field value overrides like the vendor's table, and field-level customization is better handled by Integration Field Overrides for precision and ease.
B. Configure Integration Field Overrides and Configure Integration Field Attributes
Integration Field Overrides: Correct for mapping specific field values (e.g., Cost Center → "CC"), as they allow granular control over output formats for individual fields.
Integration Field Attributes: These are less commonly used and typically focus on field-specific properties (e.g., data type, length), not broad integration settings like retention policies. Retention is not managed at the field level, so this is incorrect for the retention requirement.
Why Not Sufficient?: Integration Field Attributes do not handle retention policies, making this option incomplete.
C. Configure Integration Field Overrides and Configure Integration Attributes
Integration Field Overrides: Perfect for mapping the vendor's output values (e.g., Cost Center → "CC", Pay Group → "PAY", etc.), as they allow precise control over field-level output formatting.
Integration Attributes: Correct for configuring the retention policy (e.g., changing from 30 to 7 days), as attributes manage integration-wide settings like file retention.
Why Sufficient?: This combination addresses both requirements—field-level output formatting and integration-wide retention policy changes—making it the most accurate choice.
D. Configure Integration Maps and Configure Integration Field Attributes
Integration Maps: As explained, these are better for complex transformations, not simple field value overrides like the vendor's table. They could work but are less efficient than field overrides.
Integration Field Attributes: As noted, these do not handle retention policies or broad integration settings, making them incorrect for the retention requirement.
Why Not Sufficient?: This combination fails to address retention effectively and uses Integration Maps when Integration Field Overrides would be more appropriate for the output formatting.
Conclusion
Based on the analysis, the vendor's requirements for output formatting (mapping organization types to specific values) and changing the retention policy (from 30 to 7 days) are best met by:
Integration Field Overrides: To customize the output values for organization types (e.g., Cost Center → "CC") as shown in the table.
Integration Attributes: To adjust the document retention policy from 30 days to 7 days.
What is the relationship between an ISU (Integration System User) and an ISSG (Integration System Security Group)?
The ISU is a member of the ISSG.
The ISU owns the ISSG.
The ISU grants security policies to the ISSG.
The ISU controls what accounts are in the ISSG.
This question explores the relationship between an Integration System User (ISU) and an Integration System Security Group (ISSG) in Workday Pro Integrations, focusing on how security is structured for integrations. Let’s analyze the relationship and evaluate each option to determine the correct answer.
Understanding ISU and ISSG in Workday
Integration System User (ISU):An ISU is a dedicated user account in Workday specifically designed for integrations. It acts as a "robot account" or service account, used by integration systems to interact with Workday via APIs, web services, or other integration mechanisms (e.g., EIBs, Core Connectors). ISUs are typically configured with a username, password, and specific security settings, such as disabling UI sessions and setting session timeouts to prevent expiration (commonly set to 0 minutes). ISUs are not human users but are instead programmatic accounts for automated processes.
Integration System Security Group (ISSG):An ISSG is a security container or group in Workday that defines the permissions and access rights for integration systems. ISSGs are used to manage what data and functionalities an integration (or its associated ISU) can access or modify within Workday. There are two types of ISSGs:
Unconstrained:Allows access to all data instances secured by the group.
Constrained:Limits access to a subset of data instances based on context (e.g., specific segments or data scopes).ISSGs are configured with domain security policies, granting permissions like "Get" (read), "Put" (write), "View," or "Modify" for specific domains (e.g., Worker Data, Integration Build).
Relationship Between ISU and ISSG:In Workday, security for integrations is managed through a hierarchical structure. An ISU is associated with or assigned to an ISSG to inherit its permissions. The ISSG acts as the security policy container, defining what the ISU can do, while the ISU is the account executing those actions. This relationship ensures that integrations have controlled, audited access to Workday data and functions, adhering to the principle of least privilege.
Evaluating Each Option
Let’s assess each option based on Workday’s security model for integrations:
Option A: The ISU is a member of the ISSG.
Analysis:This is correct. In Workday, an ISU is assigned to or associated with an ISSG to gain the necessary permissions. The ISSG serves as a security group that contains one or more ISUs, granting them access to specific domains and functionalities. For example, when creating an ISU, you use the "Create Integration System User" task, and then assign it to an ISSG via the "Assign Integration System Security Groups" or "Maintain Permissions for Security Group" tasks. Multiple ISUs can belong to the same ISSG, inheriting its permissions. This aligns with Workday’s security framework, where security groups (like ISSGs) manage user (or ISU) access.
Why It Fits:The ISU is a "member" of the ISSG in the sense that it is linked to the group to receive its permissions, enabling secure integration operations. This is a standard practice for managing integration security in Workday.
Option B: The ISU owns the ISSG.
Analysis:This is incorrect. In Workday, ISUs do not "own" ISSGs. Ownership or control of security groups is not a concept applicable to ISUs, which are service accounts for integrations, not administrative entities with authority over security structures. ISSGs are created and managed by Workday administrators or security professionals using tasks like "Create Security Group" and "Maintain Permissions for Security Group." The ISU is simply a user account assigned to the ISSG, not its owner or controller.
Why It Doesn’t Fit:Ownership implies administrative control, which ISUs lack; they are designed for execution, not management of security groups.
Option C: The ISU grants security policies to the ISSG.
Analysis:This is incorrect. ISUs do not have the authority to grant or modify security policies for ISSGs. Security policies are defined and assigned to ISSGs by Workday administrators or security roles with appropriate permissions (e.g., Security Configuration domain access). ISUs are passive accounts that execute integrations based on the permissions granted by the ISSG they are assigned to. Granting permissions is an administrative function, not an ISU capability.
Why It Doesn’t Fit:ISUs are integration accounts, not security administrators, so they cannot modify or grant policies to ISSGs.
Option D: The ISU controls what accounts are in the ISSG.
Analysis:This is incorrect. ISUs do not control membership or configuration of ISSGs. Adding or removing accounts (including other ISUs) from an ISSG is an administrative task performed by users with security configuration permissions, using tasks like "Maintain Permissions for Security Group." ISUs are limited to executing integration tasks based on their assigned ISSG permissions, not managing group membership.
Why It Doesn’t Fit:ISUs lack the authority to manage ISSG membership or structure, as they are not administrative accounts but integration-specific service accounts.
Final Verification
Based on Workday’s security model, the correct relationship is that an ISU is a member of an ISSG, inheriting its permissions to perform integration tasks. This is consistent with the principle of least privilege, where ISSGs define access, and ISUs execute within those boundaries. The other options misattribute administrative or ownership roles to ISUs, which are not supported by Workday’s design.
Supporting Information
The relationship is grounded in Workday’s integration security practices, including:
Creating an ISU via the "Create Integration System User" task.
Creating an ISSG via the "Create Security Group" task, selecting "Integration System Security Group (Unconstrained)" or "Constrained."
Assigning the ISU to the ISSG using tasks like "Assign Integration System Security Groups" or "Maintain Permissions for Security Group."
Configuring domain security policies (e.g., Get, Put) for the ISSG to control ISU access to domains like Worker Data, Integration Build, etc.
Activating security changes via "Activate Pending Security Policy Changes."
This structure ensures secure, controlled access for integrations, with ISSGs acting as the permission container and ISUs as the executing accounts.
Key References
The explanation aligns with Workday Pro Integrations documentation and best practices, including:
Integration security overviews and training on Workday Community.
Guides for creating ISUs and ISSGs in implementation documentation (e.g., NetIQ, Microsoft Learn, Reco.ai).
Tutorials on configuring domain permissions and security groups for integrations (e.g., ServiceNow, Apideck, Surety Systems).
You are creating a connector based integration where all fields are provided by the template. However, the vendor would also like the following configurations as well:
• A file name output to have the current date and integration run number
• Have internal values for a particular field transferred to their external values
What workflow would you follow to create this integration?
• Enable Needed Integration Services
• Configure Integration Field Attributes
• Configure Integration Maps
• Configure Sequence Generator
• Enable Needed Integration Attributes
• Configure Integration Maps
• Configure Integration Services
• Configure Sequence Generator
• Enable Needed Integration Maps
• Configure Integration Services
• Configure Integration Field Attributes
• Configure Sequence Generator
• Enable Needed Integration Services
• Configure Integration Attributes
• Configure Integration Maps
• Configure Sequence Generator
To create a connector-based integration with additional custom configurations such as dynamic file naming and internal-to-external value mapping, the following steps must be followed:
Enable Needed Integration Services:
This step involves activating the required integration services to ensure that the necessary API calls, security, and processing capabilities are available within Workday.
Configure Integration Field Attributes:
Integration Field Attributes allow customization of fields within the integration, enabling changes to formats, mappings, and transformations, such as including a dynamically generated file name with the current date and integration run number.
Configure Integration Maps:
Integration Maps are used to transform internal values into external values as per the vendor’s requirements. This ensures that data fields in Workday align correctly with external system specifications.
Configure Sequence Generator:
The Sequence Generator is used to append unique identifiers to output files, ensuring each integration run produces a uniquely named file (e.g., including the current date and run number).
This workflow ensures that the integration is set up efficiently while meeting the vendor’s additional configuration needs.
References:Workday Advanced Business Process documentation
What attribute(s) can go into the xsl:stylesheet element?
XSLT Version & Namespaces
XSLT Version & Encoding
XML Version & Namespaces
Namespaces & Encoding
The
XSLT Version– This defines the XSLT specification version being used (e.g., version="1.0" or version="2.0").
Namespaces– XSLT operates within an XML namespace (xmlns:xsl="http://www.w3.org/1999/XSL/Transform"), which is required to define the transformation rules.
Breakdown of Answer Choices:
A. XSLT Version & Namespaces✅(Correct)
The
Example:
xml
CopyEdit
B. XSLT Version & Encoding❌(Incorrect)
Encoding (encoding="UTF-8") is a property of the XML declaration (), not an attribute of
C. XML Version & Namespaces❌(Incorrect)
XML version () is part of the XML prolog, not an attribute of
D. Namespaces & Encoding❌(Incorrect)
Encoding is not an attribute of
Final Correct Syntax:
This ensures that the XSLT file is processed correctly.
Workday Pro Integrations Study Guide References:
ReportWriterTraining.pdf – Chapter 9: Working With XML and XSLTcovers XSLT basics, including the required attributes for
Workday_Advanced_Business_Process_part_2.pdf – Chapter 5: Web Services and Integrationsdetails how Workday uses XSLT for transformations .
