> For the complete documentation index, see [llms.txt](https://docs.cortex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.io/ingesting-data-into-cortex/integrations/workday/using-the-integration-for-workday.md). # Using the integration for Workday How to use the integration for Workday in Cortex {% hint style="info" %} Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor's documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance. {% endhint %} This article explains how to use the integration for Workday with Cortex. For configuration instructions, see [Configuring the integration for Workday](/ingesting-data-into-cortex/integrations/workday.md). {% hint style="info" %} Cortex conducts a background sync of Workday identities every day at 9 a.m. UTC. {% endhint %} ## Connecting an entity to Workday ### Discovering entities automatically By default, Cortex matches entities to Workday teams using the [Cortex tag](/ingesting-data-into-cortex/entities-overview/entities.md#cortex-tag). For example, an entity with the tag `platform-infra` maps to a Workday team named `platform-infra`. If your Workday team names don't align with your Cortex tags, override the mapping in the entity descriptor. {% hint style="info" %} Team names are case-sensitive and must exactly match the `teamDisplayName` or `teamName` field in your Workday report. {% endhint %} ### Importing teams automatically You can choose to automatically import discovered teams and team relationships from Workday into Cortex. Before enabling auto import, make sure your Workday report includes the `managerEmail` field to ensure that team relationships are imported. 1. From the main sidebar, click your avatar in the bottom-left corner. 2. Click **Settings**. 3. In the Settings menu, locate the **Workspace** section, then expand **Entities**. 4. Select **Teams**. 5. In the Team settings section, toggle on **Auto import Workday teams**.

6. At the top of the page, select the **Identity providers** tab.

7. Locate Workday, then toggle on the **Enabled** option. The next automatic import occurs when the background entities sync runs at 9 a.m. UTC. {% hint style="info" %} If a Workday team you're importing shares a tag with an existing Cortex entity, Cortex appends `-team` to the imported team's tag to avoid a collision. For example, if the tag `payments` already exists in Cortex when you import a Payments team from Workday, Cortex imports the team's tag as `payments-team`. {% endhint %} {% hint style="info" %} When Cortex processes a sync, it checks whether a deleted team is backed by a non-Cortex provider before re-creating it. A Workday-managed team is only re-created if (1) a service YAML references it as an owner, or (2) the team's own YAML is re-processed. {% endhint %} ### Importing teams from the catalog If you'd rather choose which Workday teams to bring into Cortex than import all of them, you can select them from the catalog. Cortex builds the team hierarchy as part of the import, so the teams arrive with their parent and child relationships already in place. 1. From the main sidebar, expand **Catalogs**, then select **All entities**. 2. Click **Import entities**, then select **Import discovered entities**. 3. Select Workday as the source. 4. On the **Select entities to import** page, click **Sync entities**. * The daily background sync also stores the hierarchy, so an integration that's been connected longer than a day is already covered. 5. Select the teams you want, then click **Next step**. The **Edit details** page is displayed. 6. Review the information, make any necessary changes, then click **Confirm import**. See [Importing teams from an integration](/ingesting-data-into-cortex/entities-overview/entities/adding-entities/teams.md#importing-teams-from-an-integration) for more information. Cortex creates the teams, their members, and their hierarchy relationships. {% hint style="info" %} Cortex stores your Workday hierarchy separately from your teams, so you can delete Workday teams and import them again without losing their relationships. To pick up an org structure change from Workday, run a sync before you import again. {% endhint %} #### **Triggering a sync manually** You can sync teams manually at any time. Note that performing a manual sync does not create new teams, but it does update membership and hierarchy relationships for existing Workday-managed teams. 1. From the main sidebar, select **Integrations**. 2. Locate Workday, then click **Settings**. 3. In the **Sync team for Workday** section, click **Sync teams**.\

{% hint style="info" %} Manual sync updates membership and hierarchy for existing Workday-managed teams. It does not create new teams and will not re-create a deleted team unless a service YAML references it as an owner or the team's own YAML is re-processed. {% endhint %} ### Connecting via entity descriptor For any entity type, use the entity descriptor to assign Workday teams as owners by referencing the team's Cortex tag. Assigned teams then appear as owners on the entity's page in Cortex, linking it to the team members and hierarchy imported from Workday. ```yaml x-cortex-owners: - type: group name: workday-team-tag provider: CORTEX description: This is a description for this owner. ```

Field	Description	Required?
`type`	Ownership type (in this example, `group`).
`name`	The Cortex tag linked to the auto-created Workday team.
`provider`	The source of the team (in this example, a Cortex-created team).
`description`	Description for the owner.

## Using the Workday integration #### Entity pages Once you set up the integration, Cortex imports and structures your team hierarchy automatically. Imported Workday teams display the description ***Automatically created by Cortex***. Each team's details page lists detected members under the **Members** tab. If your Workday report includes the `role` field, Cortex displays each member's role in a badge next to their name. ### Creating Scorecard rules and writing CQL queries with the Workday integration See examples below.

All ownership details

A special built-in type that supports a null check or a count check, used to enforce ownership of entities. **Definition:** `ownership: Ownership | Null` **Example** An initial level in a security Scorecard might include a rule to ensure an entity has at least one team as an owner: ``` ownership.teams().length > 0 ```

All owner details

List of owners, including team members and individual users, for each entity. **Definition:** `ownership.allOwners()` **Example** The Scorecard might include a rule to ensure that entity owners all have an email set: ``` ownership.allOwners().all((member) => member.email != null) ```

Team details

List of teams for each entity. **Definition:** `ownership.teams(): List` **Example** The Scorecard might include a rule to ensure that an entity owners all have a description and are not archived: ``` ownership.teams().all(team => team.description != null and team.isArchived == false) ```

## Viewing Workday integration logs {% hint style="info" %} This feature is available in Cortex cloud. {% endhint %} While viewing an integration's settings page, select the **Logs** tab to view error logs from the last 7 days. You can filter the logs list by configuration and by operation (for example, you could filter to view errors surfaced only via Scorecards).

The 'Logs' tab on an integration's settings page shows error information over the past 7 days.

Click into a row to get more information, including time stamp, status code, full error, and request path. ## Known limitations Cortex does not support hierarchies with cycles. For example, if **Employee A** is on the platform team and **Employee B** is on the frontend team, and both report to **Manager C** on the engineering team, the hierarchy is valid. But if **Manager C** also reports to someone on the platform team, that creates a cycle between the platform and engineering teams which Cortex cannot resolve. If your Workday data contains cycles, set **Root Team Ids** in the **Hierarchy Fields** section of your report mappings to the team you expect at the top of the hierarchy. Cortex uses it to break cycles it finds below that team. Teams created outside the catalog import flow, such as through the Cortex API, don't get their Workday hierarchy right away. Their relationships are created on the next sync, either the daily background sync or a manual sync.