Salesforce Workday Integration: Options, Setup and Pitfalls

What a Salesforce Workday integration actually does

Workday knows who works for you, where they sit and who they report to. Salesforce knows your customers, pipeline and deals. People search for a “Workday Salesforce connector” for very different reasons, so name your flow first.

• Worker to Salesforce user (joiner, mover, leaver). A new sales rep in Workday gets a Salesforce user with the right profile, role and permission sets. A promotion changes them. A termination deactivates the login. This is the most common reason to integrate.
• Org data for sales operations. Manager, department, cost center, location and sales region flow into Salesforce so role hierarchies, territories, approvals and commission reports match the real org chart.
• Finance and planning. If you run Workday Financials, a won deal can create a Workday customer and customer contract for billing and revenue. Workday Adaptive Planning can pull Salesforce data for sales planning and forecasting.
• Professional services. A Closed Won opportunity with services becomes a project in Workday’s professional services automation (PSA), so resourcing starts before the kickoff call.

The first flow is about identity and access. The others are about business records. They are usually built with different tools, and this guide covers both. For the wider picture, start with our Salesforce integration guide.

Your integration options compared

There is no single Workday-built sync with Salesforce that covers all four flows. In July 2024 the two companies announced a strategic partnership with plans for an AI employee service agent and a shared data foundation built on Salesforce Data Cloud (now called Data 360) and Workday; ask both vendors what is generally available for your editions today. For the flows above, these are the realistic routes.

1. Identity provider: Okta or Microsoft Entra ID

If your goal is “every sales hire gets a Salesforce login and every leaver loses it,” do it in the identity layer, not with a point-to-point HR sync. According to Okta’s documentation, Workday can act as a profile source: Okta imports new workers, attribute changes, rehires and prehires (based on a pre-start interval), and on termination deactivates the user and their accounts in downstream apps. Okta imports only workers with the First Day Of Work and Hire Date attributes populated. Okta’s Salesforce integration then pushes new users and profile updates and deactivates Salesforce accounts.

Microsoft’s documentation describes the same pattern for Entra ID: a Workday inbound provisioning app reads workers through Workday’s Human Resources web service and creates, updates and disables accounts on hire, change and termination; a separate Workday writeback app can write email, username and phone numbers back to Workday. A separate Salesforce provisioning app then creates and updates Salesforce users. Both identity providers also give you single sign-on, so there is no separate Salesforce password to forget or revoke.

2. Workday’s own integration tools

Workday ships three layers of integration tooling. According to Workday’s documentation, connectors are packaged integrations with common third-party services, Enterprise Interface Builder (EIB) is a simple tool for building integrations without programming, and Workday Studio is an Eclipse-based development environment for more complex integrations that Workday hosts and runs for you. Underneath sit Workday Web Services (SOAP), REST APIs and web-service-enabled custom reports (often called Reports-as-a-Service, or RaaS). These tools are strongest for outbound extracts, such as a scheduled file of active sales workers, and need a Salesforce-side loader or API client to finish the job.

3. MuleSoft

MuleSoft offers the Anypoint Connector for Workday. MuleSoft’s documentation lists onboarding and offboarding, people analytics and financials among its use cases, and points to templates and examples on Anypoint Exchange. It suits companies that already run MuleSoft or connect Workday to several systems at once. See our Salesforce MuleSoft integration guide for how that platform is set up.

4. iPaaS: Workato, Boomi and similar

Workato and Boomi both have Workday connectors alongside their Salesforce ones. According to Workato’s documentation, its Workday connector works with Workday’s SOAP APIs, REST APIs (mainly for custom objects) and RaaS reports, requires OAuth 2.0 for REST, and recommends an integration system user so the integration doesn’t break when a person’s account changes. An iPaaS is a good fit for business-data flows, such as won deals into Workday Financials or org data into Salesforce territories, when a RevOps or IT team will own the recipes.

5. Custom integration

Your developers call Workday Web Services or REST on one side and the Salesforce REST, Bulk or Platform Events APIs on the other, usually through a small service with a queue. The public Workday Web Services directory listed version v47.0 (2026R2) as of October 2026, with services such as Human_Resources, Staffing, Financial_Management, Revenue_Management, Resource_Management and Professional_Services_Automation. You can also search AppExchange (now AgentExchange) for partner-built Workday apps, but vet what they sync and where data is stored.

Cost levels are relative. Integration vendors quote by connections, tasks or volume, so ask for a written quote that names the flows and record counts you plan to sync.

Which option fits you

Four questions, under a minute. The result is a starting point, not a final architecture.

Field and object mapping

Agree on this table with HR, IT and sales ops before anyone configures a tool. The “system of record” column decides which side wins when both change.

Keep a short “do not sync” list next to the table: compensation, bonus and commission plans, national IDs, home addresses, dates of birth, benefits, leave reasons and performance ratings stay in Workday.

How to set up the integration, step by step

These steps follow the most common path: Workday workers provisioned into Salesforce through an identity provider, plus one business-data flow through an iPaaS. A custom build follows the same order with code in place of configuration.

1. Write down the flows and ownersOne page: which workers get Salesforce (for example, sales and customer success job families), which fields flow, which event triggers what, and who owns each field. Get sign-off from HR, IT and sales ops.
2. Create a Workday integration system userA dedicated integration system user (ISU) in an integration system security group with only the domain permissions the flow needs, and UI sessions disabled, as Okta’s Workday guide describes. Never use a person’s Workday login.
3. Prepare the Salesforce sideWork in a Salesforce sandbox first. Create the profiles and permission set groups that job profiles map to. For iPaaS or custom flows, create an API-only integration user with a permission set limited to the synced objects; supported editions include a limited number of Salesforce Integration user licenses at no extra cost. For identity-provider provisioning, follow your provider’s guide for the admin account it needs.
4. Connect Workday to the identity providerIn Okta, enable Workday as a profile source and rank it above the directory users are created in. In Entra ID, add the Workday inbound provisioning app. Scope it to a handful of test workers first; Microsoft recommends a scoping filter before the first full sync.
5. Map attributes and the matching keyMatch on Workday employee ID, not email. Map name, work email, title, manager, department, cost center and location. Decide how a job profile picks a Salesforce profile and permission sets. Entra ID maps one app role to the Salesforce profile, so plan the rest with groups or Salesforce-side rules.
6. Connect the identity provider to SalesforceTurn on provisioning to the Salesforce sandbox, assign test users, and confirm create, update and deactivate each work. Watch for Salesforce email change approvals and license limits, which Microsoft lists among common provisioning errors.
7. Build the business-data flowPick one flow, for example cost center and region to Salesforce, or Closed Won to a Workday customer contract. Use the stored IDs for matching, send only changed fields and skip changes made by the integration user to avoid loops.
8. Test joiner, mover, leaver and rehireHire with a future start date, transfer to another team, change manager, terminate effective today, terminate effective next month, and rehire. Check what the user can see at every step, and who owns their records after they leave.
9. Set alerts, an owner and go liveRoute failed records to a named person with the reason. Run a first full sync in a quiet window, review the audit report, then widen the scope in stages.

Built by Gilzor

Results we’ve shipped

70+products launched

98%delivered on time

85%clients come back

Aviation33%faster baggage weigh-inWeb and Mobile application for Airlines→Healthcare+30%lab test ordersMedical Lab Web and Native Mobile Applications→Retail · Startup700+stores aggregatedMobile application for Grocery shops→

Talk to the people who build it. Tell us about your project and get a free estimate of scope, timeline and cost.

See how we’d approach yours →

Security and PII

Workday holds salaries, IDs, addresses, health and family data. A Salesforce integration should see a thin slice of it.

• Minimum fields. Pull only the fields in your mapping table. A filtered custom report or a narrow web service request is safer than “get all workers” with every attribute.
• Least-privilege accounts on both sides. The Workday ISU gets only the domains it reads or writes. The Salesforce integration user gets only the objects and fields it touches, with field-level security on anything sensitive.
• Modern authentication. Prefer OAuth 2.0 where the tool supports it, store secrets in a vault, rotate them, and log every call under the integration user.
• Middleware is in scope. An iPaaS or custom service stores job logs and payloads. Set log retention, mask personal fields and check where the vendor hosts data.
• Privacy law. According to the California Privacy Protection Agency, CCPA rights include California residents who are employees or job applicants, and the exemption for employment data expired on December 31, 2022. Every field copied to Salesforce is one more place to answer access and deletion requests from. Check other states and countries where you employ people with counsel.

Common pitfalls and how to fix them

Version drift is the quiet one. Microsoft notes that its Workday app uses Workday Web Services v21.1 unless you put a version in the URL, and newer versions need updated attribute expressions. Whatever tool you use, pin the API version deliberately and plan upgrades, because both Workday and Salesforce ship regular releases.

Finance, planning and PSA flows

Provisioning is the common case, but the money flows deserve their own design:

• Workday Financials. Treat it like any ERP: a won deal creates a customer and a customer contract, and billing and payment status flow back to the account. The design questions match our NetSuite and SAP guides: who creates the customer, how products map, and what happens when a deal changes after it syncs.
• Workday Adaptive Planning. According to Workday’s Adaptive Planning documentation, you can set up a Salesforce data source to use Salesforce data for sales planning and forecasting; it needs the Integration Operator and Data Designer permissions, and you choose which tables and columns to import.
• Workday PSA. Create the project when the deal closes, carry the opportunity ID, and send back only what sales needs, such as project status or remaining budget for renewals.

When a custom integration makes sense

Identity providers and connectors cover the standard flows. A custom build, or custom logic on top of an iPaaS, is worth it when:

• Access rules depend on several Workday attributes plus data outside Workday, such as quota or territory plans.
• You need strict control over where HR data is processed and logged.
• Several systems share the same flow: Workday, Salesforce, a commission tool, a data warehouse.
• Volume or per-task pricing makes owning the code cheaper than a subscription.

A typical custom build has a small service with a queue, a Workday ISU calling a filtered report or web service, an API-only Salesforce integration user, idempotent writes keyed on stored IDs, masked logs, a retry and error dashboard, and automated tests for each joiner, mover and leaver case.

Our API integration cost guide and data integration cost guide break down where that money goes.

Go-live checklist

Tick what is already done. It shows how ready your integration is for real workers and deals.

FAQ

Where Gilzor fits

Gilzor’s engineers in Poland and Cyprus can map your Workday and Salesforce flows, build the integration on your identity provider, an iPaaS, MuleSoft or Workday’s APIs, and support it after launch. See Gilzor’s Salesforce integration services, or send us the flows and fields that matter.