WorkTango HRIS Configuration Guide

WorkTango has partnered with data integration connector Merge for our HRIS connections because of the volume and speed at which their platform and development teams move to add new integrations across different categories.

With just a few, clicks we are now able to seamlessly authorize HRIS platform data into our product, saving customers time and any potential headache when sharing data between these two systems.

WorkTango now supports 43 HRIS integrations with the ability to map and import custom fields.

We can automatically map all standard fields required for implementation with WorkTango. The setup is very simple and can be completed in minutes.

If desired, we can also map custom fields from the HRIS platform to several items with WorkTango.  Fields within the customers HRIS platform can become:

• Attributes
• Groups
• Point Rules

To enable this HRIS connector, you must be on WorkTango's newest user management system. Please reach out to our customer support team so they can confirm you are on the appropriate tool set, and so they can enable the connector in your WorkTango instance. If you are not on the newest system, our team can help manage your upgrade as well.

FAQs

These FAQs come up frequently as part of the connector process.  Please read them before continuing with a specific HRIS connection and configuration. 

Can an HRIS only send a portion of their population via this connection? 

At this time, our connectors are only capable of ingesting all available users from an HRIS provider.  

1. Depending on your HRIS provider you may be able to create an administrator account that has access to a subset of your users.  Using this account to sync data to the platform will only bring in that sub-set.  Please reach out to your HRIS provider to see if this functionality is available for your use.
2. We set employee status in the WorkTango platform based on the ‘Employment status’ field in your HRIS system.  If you want to import only a subset of employees, we could also override the standard mapping of ‘Employment status’ with a custom field to enable WorkTango for that subset of employees.  This new custom field would then need to be manually tracked in your HRIS to set user status to Active, Paused, and Archived. This will still import all employees from the HRIS, but will automatically archive users not desired to have an active status in our system.

Can I connect multiple HRIS systems to WorkTango?

You can configure multiple HRIS connections to one WorkTango instance.  The first connector is included as part of your subscription pricing.  Adding additional connectors costs $500 per year.

Will my HRIS charge any fees for this connection?

That is different for every HRIS system.  Some providers may have a cost associated with generating an API key or enabling integrations. Using ADP for example requires you to subscribe to our connector through their marketplace, and has an additional fee of $300 per year.  

How do we delete a connector? 

There is a button available to delete connectors.

How long does it take to setup a connector?

This tool should provide a one-call effort for the customer and Implementation team to set up the HRIS connection. This will be a very impactful reduction to implementation timelines and, ideally, eliminate a lot of back and forth between WorkTango resources and your internal resources. 

Who on the customer team can set up the WorkTango HRIS integration?

The customer Admin of WorkTango must ALSO be a Full Administrator of the HRIS system they are trying to link up to WorkTango.

How does our HRIS integration security work?

Please look at our providers details here: Trust Center

Can you support an HRIS connector and SFTP at the same time?

Yes.  Please work with our team to make sure your import settings are correctly configured to handle this implementation.

Create Connection

1. Go to Admin dashboard > Recognition & Rewards > Integrations > Merge
2. Click Add new connection  

Best Practice: All connectors should be set up with a member of the Customer Success team and a customer with Administrator access to their HRIS provider. 

Select HRIS Provider

Configure Integrations

1. The administrator making the connection in the WorkTango platform must also be a full rights administrator in the HRIS platform they are connecting to.  If the administrator is not IT savvy, it may be best to have them ride along an IT resource to the call, especially if the connector requires API credentials.
   • The user creating the integration needs to have both full Admin access to WorkTango, and the HRIS system.  They may need to enable the IT access person Administrator rights to WorkTango as part of the implementation.  This can be removed after the fact.
2. When you’re ready to begin integrating, search or choose a connector from the Merge 
3. Once selected, click 'Continue' to preview the steps or information needed to complete the integration
   • It is important to review configuration documentation prior to starting.  Merge has documentation per connector on their website, and we have included individual instructions for the most popular HRIS solutions below in this document. That includes resources for ADP Workforce Now, UKG Read, and Workday
4. Configure your import settings.

Best Practice: Read WorkTango's or Merge’s integration materials for specific HRIS system prior to configuration. Every HRIS provider is different. Some providers (like ADP) may require the customer to complete additional steps on their own to enable the connection.

HRIS Standard Fields

By default we integrate the following standard fields as part of our integration.  This sets a baseline for the data we need in our platform to enable your employees, insights, and rewards experiences.  This data comes over automatically and does not need to be mapped in any way.

Employee Data 

• Company
• Date of birth
• Display full name
• Employee number*
• Employment status
• Ethnicity
• First Name
• Gender
• Groups
• Home location
• Last Name
• Manager
• Marital status
• Mobile phone number
• Personal email
• Preferred name
• Remove created timestamp
• Start date
• Termination date**
• Username
• Work email
• Work location

Employments

• Effective date
• Employee
• Employment type
• Job title
• Pay currency
• Pay frequency
• Pay period
• Pay rate

Companies

• Display name
• Employer identification number
• Legal name

Groups

• Name
• Type

Locations

• City 
• Country
• Location Type
• Name
• Phone number
• State
• Street 1
• Street 2 
• Zip code

Override a standard field

WorkTango has the ability to override a standard field mapping with a custom field mapping.  This configuration cannot be done through the interface, and must be completed by a WorkTango team member.  Please reach out to your customer support representative for additional details.

• Employee ID: It is very important that if you have already loaded employee data into the system that we use the correct employee ID when configuring your connection.  Some HRIS systems like ADP allow the storing of multiple employee IDs, and we need to make sure that we are mapping the correct one. Please confirm the ID field you want to map and check that this is what has been loaded into WorkTango with our team prior to enabling the integration.

HRIS Custom Fields

Custom fields are only used to map Point Rules, Attributes, and Group data.  

You should not map the standard fields listed above as any of the custom fields below.

Point Rule

Create your points rule and associated values in WorkTango before beginning this step. 

1. Create a Merge customization for Point Rules by choosing Map Field during Add Connection step or Manage Connection. 
2. Click Map Field 
3. You’ll see pointRule as a possible connection. 
4. Type in the Field the customer has identified for their Points Rule assignment (this could be an existing field they have repurposed or a customized field in their HRIS)
5. In order to successfully assign the point rule, the values in that field must exactly align to the Points Rules created in the UI in WorkTango

Some HRIS systems (BambooHR as an example) don’t allow customers to create custom fields. If you want to repurpose an existing field in their HRIS to store custom point rules, they can do this, and import data from that field.

Custom Attributes 

Create your attributes in WorkTango before beginning this step. 

1. Create a Merge customization for Attributes by choosing Map Field during Add Connection step or Manage Connection. 
2. Click Map Field 
3. Click + Field Mapping
   1. Select the data model for your target field: Employee 
   2. Name your target field: Enter the name of the Attribute(s) you have created 
   3. Describe your target field: Optional
   4. Click Next 
4. Select the {HRIS Provider} field to sync data from: 
5. Type in the search box to select the field from the Customer HRIS and select 
6. Click Save 
7. Click Save Mappings > Finish Setup 

Custom Groups

Create a customization for Groups by choosing Map Field during Add Connection step or Manage Connection.

1. Click Map Field 
2. Click + Field Mapping
   1. Select the data model for your target field: Employee 
   2. Name your target field: Enter the name of the custom group with “group_” (e.g. group_scrum_team)  
   3. Describe your target field: Optional
   4. Click Next 
3. Select the {HRIS Provider} field to sync data from: 
   1. Type in the search box to select the field from the Customer HRIS and select 
   2. Click Save 
4. Click Save Mappings > Finish Setup 

After creation, this Custom Group cannot be edited. It can only be deleted. If you need to make an edit, you need to delete the mapping and recreate it as new.

Private Groups need to be manually created in the platform prior to being imported.

Delete Custom Mappings

To delete a field mapping, an authorized user needs to log into Merge. 

1. Go to Linked Accounts > Select the Account 
2. Go to Field Mapping > Employee custom fields 
3. Click the ellipses and Delete Mapping 

Testing and Demo Accounts

CS Demo to HRIS product accounts only

1. You can set up a test account between CS Demo and the your production HRIS.
2. You cannot set up a demo account to a sandbox HRIS account

Test accounts are not intended to be left connected. You will need to delete the connector after test is complete.

ADP Workforce Now will not allow multiple or test connections. You can only set up a single production account for that provider.

Multiple Connectors

You can configure multiple HRIS connections to one WorkTango instance.  The first connector is included as part of your subscription pricing.  Adding additional connectors will result in a $500 annual fee per connector.

Sync Frequency

The following details outline the frequency and methodology at which we can import data from your HRIS system:

• WorkTango always queues a nightly sync in order to get any changes that may have occurred during the last 24 hours to your HRIS system
• There is a ‘Sync now’ button on the HRIS connection management screen that allows you to force a sync between the two systems on your desired timeline.
• Depending on the HRIS integration, WorkTango's API listens for updates in your HRIS instance, and can update mid-day if it sees changes that it wants to process. Timing of this is HRIS system dependent, and not explicitly predictable for tracking on WorkTango's end. The results will show on the import history screen when a sync has started and completed

Specific HRIS Instructions

The following instructions are for our most frequently connected HRIS systems.  More information for managing connections can be found on our integration providers website.

• Merge ADP Workforce Now Documentation 

  Step 1: Get Started

  1. Select "ADP" in the Linking Flow. You will see a token that will be used in the next steps.

  

  2. Copy the token presented in the Linking Flow screen. DO NOT close this pop up window.

  Step 2: Logging into ADP to add the token

  1. Log into your ADP WorkForce Now account in a separate tab and navigate to the ADP Marketplace. You will be navigating back and forth between these two tabs throughout this process.
  2. Once logged into ADP, find the data-connector app that belongs to the business you are integrating within the ADP Marketplace and click "Buy Now".
     

     If you have our legacy connector enabled you will need to unsubscribe from that connector before purchasing the new connector.

  3. When prompted for a token in the ADP Marketplace flow, input the value you copied from the popup in Step 1.

     If you have our legacy connector enabled you will need to unsubscribe from that connector before purchasing the new connector.

  4. Finish the ADP Marketplace Subscription flow, and return back to the original linking flow screen from Step 1 to complete the rest of the linking process. 
  5. A "Next Step" button should now appear clickable in the original popup window. Click this button to go to the next step. 

  

  Step 3: Providing Consent in ADP

  1. Back in ADP, navigate to the "My Apps" section in ADP's Marketplace, and click on the data connector app from earlier. 
  2. You will be prompted to provide consent to the access of data. If it does not prompt you, you likely have already consented to the business you're integrating with, and you can skip this step.

  Step 4: Connect the Integration

  1. Navigate back to the original linking popup window and click “I have provided consent” after providing consent in ADP’s Marketplace.

  

   Your account is now linked, and the initial sync of the ADP account data has begun!

• Merge BambooHR Documentation 

  Step 1: Get Started

  1. Select "Bamboo" in the Linking Flow. 
  2. Add in your subdomain for your BambooHR Account to Merge Link.
  3. You will be redirected to BambooHR to log in to your account. 

  Step 2: Enter your BambooHR account credentials.

  Once entered, your Authentication is complete!

• Merge UKG Pro Documentation

  Step One: Find your UKG Pro Customer API Key.

  1. You'll want to login to your UKG Pro account and search Service Account Administration in your search bar on the top right.
     
     
  2. Copy the Customer API Key from under the header.
     
     
  3. Open the Integration interface in WorkTango
     • Search and select UKG
     • Paste the Customer API Key in Merge Link.

  

  Step Two: Create your Service Account

  1. On the UKG Pro Service Account Administration Page, click on "+ add" in the upper right hand side.

     

  2. Enter in the admin of your UKG Pro account's username and email. You will need the username later.

     

  3. Scroll down under Web Service to enable permissions.
     
     • View Employee Person Details
     • Employee Employment Information
     • Company Configuration Integration
     • Personnel Integration
     • Employee Job History Details
     • Employee Person Details

       

  4. Click Save. Your new password will pop up. Save the password in a secure location.

     

  5. Enter your UKG Pro service account credentials in Merge Link and click Submit. This should be the user name of your admin service user and the password you just generated.

  

  Step Three: Finding your UKG Web Service Domain.

  1. In your search bar, search for Web Services.

  

  2. Look at any of the "web service endpoint URLs" and find your subdomain.
  3. For example, if your URL is http://Servicet.ultipro.com/services/BIDataService then your subdomain is "Servicet". 

  

  4. Find your top-level domain.

  For example, if your URL is http://Servicet.ultipro.com/services/BIDataService then your top level domain is "ultipro.com". 

  

  Step Four: Complete Merge Link

  1. On the "Enter your UKG Pro Web Services URL (Part 1) screen, enter your subdomain.

  

  2. Click Submit. On the "Enter your UKG Pro Web Services URL (Part 2)" screen, select the URL that matches your top level domain.

  

• Merge Workday Documentation

  Before linking your Workday, we'll need to make sure that the correct permissions are enabled. Below are some detailed steps for granting permissions. Steps One through Five are done within your Workday portal, whereas the last step is done on your Merge Link prompt.

  Step One: Create an Integration System User (ISU)

  1. In your Workday portal, log into the Workday tenant.
  2. In the Search field, type Create Integration System User.
  3. Select the Create Integration System User task.

  

  4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password.
  5. Click OK.

  

  Due to xml encoding, "&", "<", and ">" cannot be included in the password.

  Ensure Require New Password at Next Sign In is NOT checked. 

  You'll want to add this user to the list of System Users to make sure the password doesn't expire.

  Step Two: Create a Security Group and Assign an Integration System User

  Now, add this Integration System User to a Security Group:

  1. In the Search field, type Create Security Group.

  

  2. Select the Create Security Group task.
  3. Click OK.
  4. On the Create Security Group page, from the Type of Tenanted Security Group pull-down menu, select Integration System Security Group (Unconstrained).
  5. In the Name field, enter a name.
  6. Click OK.
  7. On the Edit Integration System Security Group (Unconstrained) page, in the Name field, enter the same name you entered when creating the ISU in the first section.

  

  8. Click OK.

  Step Three: Configure Domain Security Policy Permissions

  1. In the Search field, type Maintain Permissions for Security Group

  

  2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2. 

  

  3. Add the corresponding Domain Security Policy with GET operation:

  

  The permissions listed below are the required permissions for the full HRIS API. Permissions can differ from implementation to implementation.

  Parent Domains for HRIS: Job Requisition Data Person Data: Name Person Data: Personal Data Person Data: Home Contact Information Person Data: Work Contact Information Worker Data: Compensation Worker Data: Workers Worker Data: All Positions Worker Data: Current Staffing Information Worker Data: Public Worker Reports Worker Data: Employment Data Worker Data: Organization Information Reports: Pay Calcuation Results for Worker (Results) Worker Data: Time Off** ** Specific instructions to allow access to Time Off data can be found here.

  Parent Domains for ATS: Candidate Data: Job Application Candidate Data: Personal Information Candidate Data: Other Information Pre-Hire Process Data: Name and Contact Information Job Requisition Data Person Data: Personal Data Person Data: Home Contact Information Person Data: Work Contact Information Manage: Location Worker Data: Public Worker Reports

  For a more detailed breakdown of the functional areas that are needed, see here.

  Step Four: Activate Security Policy Changes  

  1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved. 

  

  2. Add any relevant comments on the window that pops up
  3. Confirm the changes in order to accept the changes that are being made. 

  

  Step Five: Validate Authentication Policy is Sufficient

  Check the Manage Authentication Policies section to ensure the ISU you created is added to a policy that can access the necessary domains. It should not be restricted to only the "SAML" Allowed Authentication Types – if this is the case, you can create a new Authentication Policy with a "User Name Password" Allowed Authentication Type.

  1. Editing Authentication Policies 

  

  2. Create an Authentication Rule, and add the Security Group to the Rule

  

  3. Make sure the Allowed Authentication Types is set to specific User Name Password or set to Any

  

  Step Six: Activate All Pending Authentication Policy Changes

  1. In the search bar type, Activate All Pending Authentication Policy Changes

  

  2. Proceed to the next screen, and confirm the changes. This will save the Authentication Policy that was just created.

  

  Step Seven: Obtain the Web Services Endpoint for Workday Tenant

  We'll need access to your specific Workday web services endpoint:

  1. Search in Workday for Public Web Services.

  

  2. Open Public Web Services Report.
  3. Hover over Human resources and click the three dots to access the menu.
  4. If you are integrating with your Workday ATS, please find Recruiting instead and access that menu.
  5. Click Web Services > View WSDL.
  6. Navigate to the bottom of the page that opens and you'll find the host.
  7. Copy everything until you see /service. This should look something like https://wd5-services1.myworkday.com/ccx.

  

  Enter Credentials into Merge Link

  1. Open the Integration interface in WorkTango
  2. Search and select Workday
  3. Workday URL: Enter the Web Services Endpoint you found from Step 5 into Merge Link.

  

  4. User ID: Enter the Integration System User name for the user created in Step One.
  5. Password: Enter the Integration System User password for the user created in Step One.
  6. Workday Tenant Name: Enter your Workday Tenant name.
  7. Example: If you sign in at "https://wd5-services1.workday.com/acme", enter "acme".

  Linked Accounts: Linked Implementation Workday accounts will result in slower syncs as there are fewer resources dedicated to the tenant.
  
  The password used cannot contain an "&" or "<", ">" signs.
  
  Please make sure to exempt the ISU Account from MFA and SSO.
  
  Location Name: The WorkDay API does not send location name as part of the payload from Workday's API. We pull a location's remote ID from the wd:ID field returned in the wd:Address_Data object. The result of this is location names show up in our system as numeric IDs.
  
  If this is an issue you would like to resolve as part of your implementation, please work with your WorkTango implementation manager or customer success team member to choose a field that you would like to map or override to replace this data in the WorkTango platform. The process for this is documented above in the ‘HRIS Standard Fields, Override a standard field’ section.