---
updatedAt: 2026-01-06T21:53:37.000Z
---

# Workday | PS

Workday provides cloud-based software specializing in applications for financial management, enterprise resource planning, and human capital management. Integrating Workday with Password Safe allows the **Change Password** action to be performed for Workday managed accounts. Test Managed Account and Test Functional Account features are not implemented.

> ℹ️
>
> BeyondTrust recommends the assistance of the Professional Services Team to implement this integration. Contact your BeyondTrust Account Manager to discuss costs and time requirements for this service.

## Prerequisites

Before implementing the integration, ensure the following prerequisites are met:

* Access to Workday cloud tenant
* The **DistinguishedName** for the managed account needs to be the WorkerID (e.g. 156) for the managed account
* Name for the managed account is format *ma01\@tenant*
* Default password policy configured in Password Safe with no spaces and at least one special character
* Workday functional account in Password Safe needs access to Workday cloud tenant API and this function: **Update\_Workday\_Account**
* Access to Password Safe Cloud instance, or on-premises version 23.1.1 or later release

## Create a password policy

> ℹ️
>
> Simple Object Access Protocol (SOAP) is a message specification for exchanging information between systems and applications. Take care when adding special characters to the password policy. Some special characters, such as **<** ,will break the SOAP body.

1. Sign in to the BeyondInsight console as a BeyondInsight administrator.

2. Go to **Configuration > Privileged Access Management Policies > Password Policies**.

3. Click **Create New Password Policy**.

   ![Create new password policy](https://files.readme.io/a62f3ee2064f4d06160fd9e8878c54c7ed31669197893f9e57966f875e99d204-image.png)

4. Type in a name and then scroll down to the bottom and remove special characters other than **!** and **@**.

5. Click **Update Password Policy**.

## Create a functional account

Still logged in as a BeyondInsight administrator, create a functional account as follows:

1. Go to **Configuration > Privileged Access Management > Functional Account**.
2. Click **Create New Functional Account**. Fill out all required fields.
3. Select **Cloud** from the **Entity Type** dropdown.
4. Select **Workday** from the **Platform** dropdown.
5. Type in the username in the format of *Username\@tenantid*.
6. Enter the URL in the **Domain/LDAP server** field (e.g.; *wd2-impl-services1.workday.com*)
7. Enter the password and confirm it.
8. Enter an alias name. The alias can be the same as the username.
9. Select the appropriate workgroup from the **Workgroup** dropdown.
10. Click **Create Functional Account**.

## Create a managed system

1. From the left menu in the console, click **Managed Systems**.
2. Click **Create New Managed System**.
3. Select **Cloud** from the **Entity Type** dropdown.
4. Select **Workday** from the **Platform** dropdown.
5. Enter a **Name**.
6. Enter the **Access URL**.
7. Select the same workgroup as the functional account from the **Workgroup** dropdown. Fill out all required fields.
8. Expand the **Credential** section and select the functional account.
9. Click **Create Managed System**.

## Create a managed account

1. From the left menu in the console, click **Managed Systems**.
2. Select **Platform** from the **Filter by** dropdown, and then select **Workday** from the **Platform** dropdown.
3. Click the vertical ellipsis to the right of the Workday managed system and select **Go to Advanced Details**.
4. Under **Advanced Details**, select **Managed Accounts**.
5. Click **Create New Managed Account**.
6. Enter the name in the format of *ma01\@tenant*.
7. Enter the WorkerID (e.g. 156) for the managed account in the **Distinguished Name** field.
8. Click **Create Account**.

> ℹ️
>
> If you encounter any issues or errors, contact [BeyondTrust Support](http://www.beyondtrust.com/support) for additional assistance.