Hires, transfers and leavers in Workday HCM become correct Salesforce users, roles and territory assignments the same day, and won opportunities reach Workday Financials or your PSA without a spreadsheet in between.
California-based leadership · Serving US and international teams
Share your objects, volumes, and timing needs — we'll come back with a written scope.
Please share the systems and workflow—not credentials or customer records. We’ll confirm API access, scope and next steps.
Part of NVIDIA’s program for startups building with AI and accelerated computing.
About the program
Pravin’s experience includes Google and SmartBear. Sravan previously held leadership roles at JPMorgan Chase and First Republic Bank.
Meet the founders9110 Alcosta Blvd Ste H345, San Ramon, CA 94583
US-led delivery, with engineering in India. Supporting US and international organizations.A Salesforce Workday integration is mostly about people: every seller, manager and consultant hired, moved or terminated in Workday needs a matching Salesforce user, role and territory, and a new owner for their records when they leave. Workday is the system of record for workers, positions, supervisory organizations and cost centers; Salesforce is where that structure shows up as users, the role hierarchy, territories and PSA resources. The reverse flow matters to finance: won opportunities, customers and projects can be created in Workday Financials, or stay in Certinia PS Cloud on the Salesforce platform with Workday supplying the people and cost data. AIONDATA, an independent consultancy and not a partner of either vendor, builds this on Workday Web Services, Reports as a Service and the Salesforce REST, Bulk and SCIM APIs, or configures Workday’s own Salesforce connectors and MuleSoft where they fit.
These decisions shape the scope, cost and acceptance tests. The flows below describe possible implementation behavior, not a preinstalled connector or a guarantee for every product edition.
Decide by job profile, supervisory organization, company and worker type who gets a user and which license and profile they get. Get_Workers returns employees and contingent workers alike, so the rule must be explicit and should live in a mapping table that HR and RevOps can edit.
If Microsoft Entra ID or Okta already provisions accounts from Workday, Salesforce can be one more SCIM 2.0 target of the identity provider, and the integration adds only what SCIM does not carry: role hierarchy, territories, manager and record reassignment. Without one, the integration creates and deactivates users itself. Either way, one owner per User field.
Supervisory organizations and managers can drive the Salesforce role hierarchy and forecast rollups; positions, locations and regions can drive territory membership. Agree how a Workday reorganization maps to UserRole changes and what happens to open opportunities when a rep changes territory.
Hire, Change Job and Termination business processes can include an Integration step that launches an Integration Process Event, so provisioning starts when HR completes the transaction. Organizations, cost centers and projects change less often and suit a scheduled Reports as a Service or EIB pull. Salesforce-originated triggers use Change Data Capture.
Choose whether a closed-won opportunity creates a customer, customer opportunity, customer contract or project in Workday, and which system owns billing address and payment terms afterwards. On Certinia PS Cloud, projects and resources stay on the Salesforce platform and Workday supplies workers and cost centers.
Field mapping
The records, match keys and triggers most implementations start from. Your scope confirms each row against your editions, custom fields and business rules.
| Source | Target | Match key | Direction | Trigger | Notes |
|---|---|---|---|---|---|
| Worker (Get_Workers: worker ID, legal name, work email, job profile, time type, hire date) | User (Username, Email, FirstName, LastName, Alias, FederationIdentifier, EmployeeNumber, ProfileId, IsActive) | Workday worker ID in an external ID field on User; upsert by external ID | Workday → Salesforce | Integration step on the Hire business process (Integration Process Event), plus a nightly RaaS reconciliation pull | Only workers in the provisioning table. Username must be in email form and unique across all Salesforce orgs. |
| Termination (Terminate_Employee) or contract end (End_Contingent_Worker_Contract) | User.IsActive = false; owned Accounts, Opportunities and Cases reassigned | Workday worker ID on User | Workday → Salesforce | Integration step on the Termination business process, effective on the termination date | Salesforce users cannot be deleted; deactivation frees the license. Reassignment rule: manager from Workday, territory owner or a holding user. |
| Worker’s manager (from Get_Workers) | User.ManagerId | Manager’s worker ID → User external ID | Workday → Salesforce | Change Job business process event, plus the nightly pull | A manager without a Salesforce user leaves ManagerId empty and raises an exception for review. |
| Supervisory Organization hierarchy (Get_Organizations, type Supervisory) | UserRole hierarchy and User.UserRoleId | Supervisory organization reference ID → UserRole in a mapping table | Workday → Salesforce | Nightly EIB or RaaS pull; reorganizations rehearsed in the sandbox first | The table collapses small teams into their parent role. Role changes affect sharing and forecast rollups immediately. |
| Position (Get_Positions), Location (Get_Locations) and Region (Get_Regions) | UserTerritory2Association (Territory2Id, RoleInTerritory2) | Position or location → Territory2 in the active territory model | Workday → Salesforce | Change Job or Assign_Organization event, plus the nightly pull | Role in territory is Sales Rep by default and Owner for managers. Account assignment stays with Salesforce assignment rules. |
| Job Profile (Get_Job_Profiles) | Profile, permission set group and license mapping table; User.Title | Job profile reference ID | Workday → Salesforce | Set up once; reviewed when HR adds job profiles | Unmapped job profiles are reported, never guessed. Changing a user’s profile changes the license, so the table lists the license too. |
| Cost Center (Get_Cost_Centers) and Company (Get_Workday_Companies) | Cost Center and Company custom objects, or picklists on User and PSA records | Workday reference ID in an external ID field | Workday → Salesforce | Scheduled RaaS or EIB pull, typically nightly | Read-only in Salesforce; reused as worktags when records go back to Workday Financials. |
| Worker profile fields for services (job profile, location, time type, cost center) | Employee-type custom object, or the resource record in Certinia PS Cloud | Workday worker ID external ID | Workday → Salesforce | Hire and Change Job events, plus the nightly pull | Only the fields the PSA needs; compensation and personal data stay in Workday. |
| Project Resource Assignments and Project Worker Roles (Get_Project_Resource_Assignments, Get_Project_Worker_Roles) | PSA assignment or a custom Project Role object | Workday project and worker reference IDs | Workday → Salesforce | Scheduled pull, typically nightly | Only when Workday Projects is the resourcing system; otherwise the PSA owns assignments and Workday receives cost and revenue summaries. |
| Closed-won Opportunity with Account and primary Contact | Workday Customer (Submit_Customer) and Customer Opportunity (Submit_Opportunity) | Salesforce Opportunity and Account IDs stored as Workday reference IDs; existing-customer check before create | Salesforce → Workday | Change Data Capture event on Opportunity when StageName becomes Closed Won | Customer created only when no reference ID or tax ID matches; the Workday customer reference is written back to the Account. |
| Won services Opportunity | Workday Customer Contract (Submit_Customer_Contract) or Project (Resource_Management) | Salesforce Opportunity ID as the Workday reference ID | Salesforce → Workday | Same Change Data Capture event, gated by record type or a services flag | Optional; contract or project is chosen per business unit. Project status can flow back to the Opportunity on a schedule. |
| Salesforce Username and work email (after provisioning) | Worker work contact information or Workday account | Workday worker ID | Salesforce → Workday | After the User is created | Optional write-back, the pattern identity providers use for email and username; needs Put access on those domains in the ISSG. |
Download this mapping as a CSV worksheet · no email required
Options, cost and timeline
A prebuilt connector is sometimes enough. This comparison shows when each route fits, what it typically costs and how long it takes.
| Approach | Typical cost | Typical time | Fits when | Watch for |
|---|---|---|---|---|
| Workday connectors (Salesforce Worker Connector, Salesforce Financial Management Connector) | Licensed through your Workday subscription; Workday publishes no price and the Marketplace listings need a sign-in | Weeks to configure, map and test in an implementation tenant | Account provisioning by user profile, department and division, and opportunity-to-customer or project creation that matches the connector’s rules | Role hierarchy, territories, PSA resource data, contingent-worker rules and record reassignment sit outside those rules; confirm what the current connector version does before planning around it |
| iPaaS (MuleSoft Anypoint Connector for Workday, or your existing platform) | Platform subscription quoted by the vendor; MuleSoft publishes no list price | Weeks for standard flows once the platform and connectors are in place | Teams already running MuleSoft or another iPaaS with Workday and Salesforce connectors and an integration team to own the flows | Connector 16.7.1 targets Workday API v46.0, so plan version upgrades; the mapping and rule logic still has to be designed, built and tested |
| Identity provider plus a thin custom layer | Your Microsoft Entra ID or Okta licenses, plus a smaller custom build quoted after discovery | Usually a few weeks, since the identity provider already creates and deactivates users | Companies that already provision from Workday through an identity provider and need Salesforce-specific role, territory and reassignment logic on top | Two systems writing to the Salesforce User need one owner per field; SCIM carries profiles, permission sets and roles, but not territories or manager-based reassignment |
| Custom integration (AIONDATA) | Quoted after a short discovery; hosting and support priced separately | Usually a few weeks for provisioning, deactivation and role hierarchy; territories, PSA data and the reverse flow extend the scope | Rules that vary by job profile, organization or country, services firms with PSA data, several Workday companies, the reverse flow to Workday Financials, or a requirement to own the code | Needs an owner for monitoring and for retesting on the Workday and Salesforce release calendars, or a support agreement |
Vendor prices are list prices from their public pages on the date shown; confirm current pricing with each vendor.
The hard part is not the API, it is the table. Get_Workers returns employees and contingent workers across every Workday company, so the integration needs an explicit list of which job profiles, supervisory organizations, companies and worker types get a Salesforce user, and which license and profile each gets; Salesforce ties the license to the profile, so the table lists both. The User carries more than a login: FederationIdentifier holds the SAML subject for single sign-on, EmployeeNumber holds the Workday worker ID, ManagerId links to the manager’s user, UserRoleId places the user in the role hierarchy, and Department, Division and Title come straight from Workday. Territories are UserTerritory2Association rows, and only the active territory model is visible to users; account assignment stays with Salesforce assignment rules.
Many Workday customers already provision accounts through an identity provider. Microsoft Entra ID’s Workday inbound provisioning reads Get_Workers with an Integration System User, creates users in Active Directory and Entra ID, and can write email and username back to Workday; Salesforce then becomes a SCIM 2.0 target at /services/scim/v2/ for users, groups, profiles, permission sets and roles. In that design our integration does not create users; it sets what SCIM does not carry, and the rule that matters is one owner per User field so the two never overwrite each other.
HR data arrives in bursts: a reorganization changes hundreds of managers at once, a Workday release weekend pauses integrations, and a Change Data Capture subscriber that disconnects has 72 hours to catch up before events expire. The integration stores every event, processes it once, and keeps failures visible until a named owner in HR or RevOps clears them.
A provisioning, deactivation and role-hierarchy scope usually takes a few weeks, including a Workday implementation tenant, a Salesforce sandbox and the security review on both sides; territories, PSA data and the reverse flow extend that. AIONDATA scopes the work in a short discovery of your Workday configuration, Salesforce customizations and identity setup, then delivers under ISO 9001:2015 and CMMI Level 3 processes from Noida with leadership in San Ramon. We run these tests with HR, RevOps and IT before go-live and repeat the short list after each Workday and Salesforce release.
Technical details last reviewed September 30, 2026. Product capabilities and prices change; confirm them for your edition.
Sources: Workday Web Services (WWS) Directory v47.0 · Workday Web Services: Human_Resources v47.0 · Workday Web Services: Staffing v47.0 · Workday Web Services: Financial_Management v47.0 · Workday Web Services: Revenue_Management v47.0 · Workday Web Services: Resource_Management v47.0 · Workday Education: Using Workday Web Services · Workday REST Directory · Workday Education: Web Services and API Integrations · Workday Administrator Guide: Reports as a Service (RaaS) · Workday datasheet: Workday Integration Cloud · Workday datasheet: Integration Cloud Connectors for HCM · Workday datasheet: Integration Cloud Connect · Workday Administrator Guide: Setup Considerations: Business Processes · Workday Education: Workday Configurable Security (integrations) · Workday Education: Security for Administrators, Integrations · Workday documentation: Connect to Workday Using OAuth (Register API Client) · Workday newsroom (June 2, 2026): New tools for developers to build, connect and verify AI agents · Workday newsroom (Sept 16, 2025): Workday Introduces Workday Data Cloud · Salesforce press release (July 24, 2024): Salesforce and Workday form strategic partnership · Salesforce Developers: Data Cloud Workday Connector · Salesforce REST API Developer Guide: Supported editions · Salesforce Developers: API request limits and allocations · Salesforce Developers: Bulk API and Bulk API 2.0 limits and allocations · Salesforce Change Data Capture Developer Guide: Allocations · Salesforce REST API Developer Guide: Upsert a record using an external ID · Salesforce Object Reference: User · Salesforce Object Reference: Territory2 · Salesforce Object Reference: UserTerritory2Association · Salesforce Help: Enterprise Territory Management · Salesforce Help: Understand the SCIM implementation · Salesforce Developers blog: Hosted MCP Servers are now generally available · Salesforce Developers: Hosted MCP Servers, get started · MuleSoft: Workday Connector 16.7 reference · MuleSoft: Workday Connector release notes (Mule 4) · Microsoft Learn: Configure Workday for automatic user provisioning with Microsoft Entra ID · Certinia: Professional Services Cloud
Outcomes
Usually three together. Workday Web Services (SOAP) are the bulk workhorse: Human_Resources exposes employee, contingent worker and organization data through operations such as Get_Workers and Get_Organizations, and Staffing covers positions, hires, job changes and terminations; the directory is at v47.0 (2026R2). Reports as a Service turns an advanced custom report into a JSON or CSV feed with exactly the worker fields you need. Workday REST APIs on the api.workday.com gateway, secured with OAuth 2.0, suit smaller real-time calls; Workday positions REST as a complement to SOAP, not a replacement for bulk work.
Through the REST API with OAuth, Bulk API 2.0 for loads above about 2,000 records, and Change Data Capture for triggers that start in Salesforce. API access is on by default in Enterprise, Unlimited, Performance and Developer Edition and is an add-on for Professional. The daily allocation is 100,000 calls plus 1,000 per Salesforce license in Enterprise, and 5,000 per license in Unlimited and Performance; a provisioning sync uses a small share. Bulk API 2.0 allows 150,000,000 records per rolling 24 hours, so the first load of every worker is not a limits problem.
The Workday worker ID is stored in an external ID field on the User, and every write uses upsert by external ID: no match creates the user, one match updates it, and more than one match returns a 300 error and writes nothing, which is the duplicate guard you want. A rehire therefore reactivates the existing user. Username must be in email form and unique across all Salesforce orgs, so we agree the pattern with IT before the first load.
No, but it should work with yours. Microsoft Entra ID provisions users from Workday’s Get_Workers operation with an Integration System User and can write email and username back to Workday, and Salesforce accepts SCIM 2.0 provisioning at /services/scim/v2/ for Users, Groups, Entitlements (profiles and permission sets) and Roles in all editions. Then the identity provider creates and deactivates the user, and our integration adds manager, role hierarchy, territory membership, cost center and record reassignment. Without an identity provider, the integration does both.
Both, by data type. Workday business processes such as Hire, Change Job and Termination can include an Integration step that launches an Integration Process Event, so provisioning starts minutes after HR completes the transaction. Organization, cost center and project data run on a schedule, often an hourly Reports as a Service pull or a nightly EIB. In Salesforce, Change Data Capture delivers Opportunity changes within seconds; the default allocation is 25,000 delivered events per day in Enterprise and 50,000 in Unlimited and Performance, with 5 objects selectable without an add-on.
Salesforce users can’t be deleted in the UI or the API, only deactivated, so the integration deactivates the user on the Workday termination date and reassigns owned records by a rule you choose: to the manager from Workday, to a territory owner, or to a holding user for review. The rule is a table, not code, so RevOps can change it without a release.
Yes. Get_Organizations returns supervisory, cost center, company and region organizations and their hierarchies, and each worker’s manager comes with the worker. We map supervisory organizations to UserRole records and set ManagerId, and map positions, locations or regions to territories in Enterprise Territory Management, which Salesforce includes in Performance and Developer Editions and in Enterprise and Unlimited with Sales Cloud. Membership is a UserTerritory2Association row with a role in territory of Owner, Administrator or Sales Rep. Rehearse a reorganization in the sandbox, because role changes affect sharing and forecast visibility at once.
Sometimes. Workday’s datasheets describe a Salesforce.com Worker Sync that provisions Salesforce and Chatter accounts with rules for user profile, department and division, and a Financial Management for Salesforce connector that creates Workday opportunities, customers and projects from Salesforce triggers; Workday Marketplace lists both behind a sign-in. MuleSoft’s Anypoint Connector for Workday 16.7.1 supports Workday API v46.0 with basic, OAuth or X.509 authentication and suits teams already on Anypoint. If your rules fit, use them and we will configure and test them. Role hierarchy, territories, PSA data, contingent-worker rules and record reassignment are where a connector usually runs out of room.
Less than the headlines suggest. The July 24, 2024 announcement described a planned AI employee service agent and a shared data foundation through Salesforce Data Cloud, with the usual note that unreleased features may not be delivered. What has shipped is a Data Cloud Workday connector (batch ingestion generally available, zero-copy query federation in beta); Workday said in September 2025 that Workday Data Cloud would reach early adopters in the first half of 2026 and general availability later that year. Those feed analytics and AI. They do not provision users, set territories or write won deals into Workday Financials.
An Integration System User that is not a person, in its own Integration System Security Group, with domain security policies granting Get on the HR domains it reads and Put only where it writes back; Workday notes that most outbound integrations need only Get. For REST and Reports as a Service over OAuth, an admin runs Register API Client, picks the authorization code grant and the scopes by functional area, and can issue a non-expiring refresh token. Every call is attributable to that ISU.
Yes, with each vendor’s current state in mind. Salesforce Hosted MCP Servers have been generally available since April 29, 2026 for Enterprise Edition and above, with every call made as the signed-in user. Workday’s Agent-Ready Tools over MCP, announced June 2, 2026, are in early access through Workday Extend Professional with general availability projected for the second half of 2026. For a cross-system question such as “who covers this territory now, and are they still an active worker”, we build a custom MCP server that reads both systems with least-privilege credentials and prepares provisioning changes for a person to approve.
The number of flows and how much logic sits in the rules. Provisioning, deactivation and role hierarchy usually take a few weeks including implementation-tenant testing and the security review; territories, PSA resource data, several Workday companies and the reverse flow into Workday Financials add to that. Ongoing cost is hosting, monitoring and the support plan; a Workday connector or MuleSoft subscription is priced by the vendor. After go-live we hand over the code, mapping workbook, runbook and alerts, or support it under an agreed plan.
Other pairs involving Salesforce or Workday.
The enquiry form is at the top of this page. Share your objects, volumes and timing needs and we'll come back with a written scope.
Go to the enquiry form