Page Comparison

Insert excerptIL:External Directory Prerequisites V21IL:External Directory Prerequisites V21nopaneltrue

Expand

title	Prerequisites

In order to connect EmpowerID to Workday, the following prerequisites need to be met:

Workday needs to be configured to allow SOAP API access
The Workday API user needs to have access to read worker and contingent worker attributes (excluding things like compensation)

Step 1 – Generate a self-signed certificate in EmpowerID

On the navbar of the EmpowerID Web interface, expand Apps and Authentication > SSO Connections and select SSO Components.
Select the Certificates tab and then click the Add button in the grid header.
Image Removed
Select Generate Self-Signed Certificate.
Image Removed
Enter the following information:
- Certificate Owner – Leave empty
- Prefer Local Machine Store – Leave empty
- Subject Name – Enter something suitable to the purpose of the certificate, such as CN=AzureCertificate
- Requires Password – Select this option; this adds a private key to the certificate
- Certificate Password – Enter a password for the certificate
Click Save to create the certificate.
Image Removed

Step 2 – Download the certificate in Base64 format

From the Certificate Details page, return to the SSO Components page by clicking the Find Certificates breadcrumb.
On the SSO Components page, select the Certificates tab and search for the certificate you just created.
Image Removed
Click the Name link for the certificate to navigate to the View page for the certificate.
On the View page for the certificate, click Export Certificate.
Image Removed
Select the desired location in which to save the certificate and click Save.

Step 3 – Register a service principal application in Azure

Log in to your Azure portal as a user with the necessary permissions to create an application in Azure AD.

In Azure, navigate to your Azure Active Directory.

On the Azure navbar, click App registrations.

On the App registrations page, click New registration.

Image Removed

Name the application, select the scope for the application (single or multitenant) and click Register.

Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used when configuring the SCIM app service.

Image Removed

Navigate to the Certificates & secrets blade for the application and click Upload certificate.

Image Removed

Select the base-64 encoded certificate you downloaded from EmpowerID and click Add.

Image Removed

Note
The public key certificate that you upload to Azure must have a corresponding private key in the EmpowerID certificate store; otherwise, an error will occur when calling Azure’s API.

Step 4 – Create an app service to host the Workday SCIM microservice

Log in to your Azure portal as a user with the necessary permissions to create an App Service.
In Azure, navigate to All Services > App Services and create a new App service.
Under Project Details, select a Subscription and then create a Resource Group for the App Service.
Under Instance Details, do the following:
- Name – Enter a name.
- Publish – Select Code.
- Runtime Stack – Select .Net Core 3.1 (LTS).
- Operating System – Select Linux.
- Region – Select the appropriate region.
Click Review + Create.
Click Create.
After the deployment of the app service completes, click Go to resource.
Change the platform for the app service to 64 Bit by doing the following:
1. On the app service navbar, under Settings, click Configuration.
2. On the Configuration blade, select the General settings tab.
3. Under Platform settings, change the Platform to 64 Bit and click Save.
4. Click Continue to confirm you want to save the changes.
On the Overview page for the app service, copy and save the URL. You will need this when you configure Azure AD Auth for the app service.
Image Removed

Step 5 – Configure authentication for the app service

Navigate to the Authentication blade for the app service and click Add identity provider.
Image Removed
Select Microsoft.
Image Removed
Add the following identity provider information:
1. App registration type – Select Pick an existing app registration in this directory.
2. Name or app ID – Select the service principal you created to provide Azure AD authentication for the microservice.
3. Issuer URL – Replace the default value with https://login.microsoftonline.com/<Your Tenant ID>
4. Restrict access – Select Require authentication.
5. Unauthenticated requests – Select HTTP 401 Unauthorized: recommended for APIs.
6. Token Store – Leave selected.
7. Click Add.
  Image Removed
After adding the Identity provider, click the Edit link for it.
Image Removed
Set the Issuer URL to https://login.microsoftonline.com/<Your Tenant ID>.
Under Allowed token audiences enter the URL for the app service.
Image Removed
Click Save.
Under Settings, select Identity.
Turn on system assigned managed identity and click Save.
Image Removed
Click Yes to confirm you want to enable system assigned managed identity and register the App Service with Azure Active Directory.
Image Removed
Back in the Overview page for the App Service, click Get Publish Profile. You will need this file when you publish the Workday microservice to Azure.
Image Removed

Step 4 – Publish the Workday Microservice to Azure

Log in to EmpowerID as a person with the necessary access to initiate the SCIM Microservice Publishing workflow.
On the navbar, expand Azure Manager and click Configuration.
Select the Tenants tab and then click the Publish Azure AD SCIM App Service action link.
Image Removed
For Application Type select Microservices and then click SUBMIT.
Image Removed
For Microservice Application select Workday SCIM Microservice and then click SUBMIT.
Image Removed
Click Choose File and browse for the browse for the Workday SCIM App Service Publisher Profile Settings file you downloaded from Azure.
Once you have selected the file, click Submit.
Click Yes to confirm that you want to publish the Workday SCIM Microservice.
Click OK to close the publish results message.

Step 5 – Create a key vault with secrets to store Workday credentials

In Azure, create a key vault if you do not already have one or want to create a new one.
Navigate to the Key Vault blade for the appropriate key vault.
On the Secrets page, click Generate/Import.

Image Removed
On the Create a secret blade, do the following to create the secret:
1. Name – Enter userName.
2. Value – Enter the username of the user account accessing the user data in your Workday instance.
3. Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the second secret:
1. Name – Enter Password.
2. Value – Enter the password of the user account accessing the user data your Workday instance.
3. Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the third secret:
1. Name – Enter tenantUrl.
2. Value – Enter the tenant URL of your Workday instance.
3. Click Create.
Back on the Secrets blade, click Generate/Import again.
On the Create a secret blade, do the following to create the fourth and final secret:
1. Name – Enter tenantid.
2. Value – Enter the tenant of your Workday instance.
3. Click Create.
  You should now have the following secrets in the key vault:
  Image Removed
Next, navigate to the Workday SCIM App Service you created earlier.
On the navbar for the App Service, under Settings, click Configuration.
Under Application settings, click New application setting.

Image Removed
In the Add/Edit application setting pane, add the following:
1. Name – Enter WORKDAY_VAULTED_CREDS.
2. Value – Enter the name of the vaulted creds you created for your Workday secrets.
3. Click OK.
  Image Removed
Click Save on the Configuration blade.
Click Continue to confirm that you want to save changes.

Step 6 – Create an account store for Workday

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.

Select the Actions tab and then click Create Account Store.

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.

Select the Actions tab and then click Create Account Store.
Insert excerptIL:Common ImagesIL:Common ImagesnameCreateAccountStoreActionnopaneltrue

Under System Types, search for Workday.

Click the record for Workday to select the type and then click Submit.

Image Removed

Enter the following information in the Azure Microservice Configuration form:

Name – Name of the account store
Microservice URL – The URL to the app service hosting the Workday SCIM microservice
Azure AppID – The ID of the application you registered in Azure AD for EmpowerID
Azure Directory (Tenant) ID – The ID of your Azure tenant
Certificate Thumbprint – Thumbprint of the certificate you uploaded to your Azure tenant

When ready, click Submit to create the account store.

Image Removed

Step 7 – Verify Workday resource system parameters

Return to the Find Account Stores page and search for the Workday account store you just created.
Click the Account Store link.
Image Removed
Select the Resource System tab and then expand the Configuration Parameters accordion at the bottom of the page.
Verify the following parameters have the correct value:
- AzureAppID
- AzureTenantID
- certificateThumbprint
- GetNewOrUpdatedUsersUrl
- MicroserviceUrl

Step 8 – Configure Attribute Flow

On the Account Store Details page for the Workday account store, select the Attribute Flow Rules tab.
Review the attribute flow and revise as needed. EmpowerID translates the attributes in Workday to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in Workday flow to the EmpowerID Person, as well as any other user accounts owned by the Person.
To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

Step 9 – Create Dynamic Hierarchy policies to generate roles and location (Optional)

If desired, you can use Dynamic Hierarchy policies to generate external roles and locations based on specific user attributes, such as Job Title and Department. The external roles and locations can then be used to map corresponding EmpowerID logical locations. Please see Use Dynamic Hierarchy Policies to Create External Roles and Locations for information on setting this up. When completed, return to this article and complete steps 10 and 11.

Step 10 – Configure the Workday account store

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.

Search for the Workday account store and click the Account Store link for it.

Image Removed

On the Account Store Details page, click the Edit link to put the account store in edit mode.

Image RemovedThis opens the edit page for the account store. This page allows you to specify the account proxy used to connect EmpowerID to your Workday instance as well as how you want EmpowerID to handle the user information it discovers in Workday during inventory. Settings that are relevant to Workday are described in the table below the image

Image Removed Insert excerptIL:Account Store Settings (Workday) V21IL:Account Store Settings (Workday) V21nopaneltrue

Edit the account store settings as needed and then enable inventory as shown below.

Step 11 – Enable Inventory on the account store

By default, EmpowerID inventories account stores once every 10 minutes. However, Workday updates user data once every 24 hours. As this is the case, EmpowerID recommends that you set the interval level to once every 12 hours or once every 24 hours. If you do not change the default, inventory still occurs, but the data in the account store will not update until Workday updates.

Connecting EmpowerID to your SAP SuccessFactors system allows you to automate your Joiner, Mover, and Leaver functions seamlessly. This article provides the information needed to connect EmpowerID to SAP SuccessFactors.

Prerequisites

To connect EmpowerID to SuccessFactors, Read permissions for the following SuccessFactors objects along wih their mentioned attributes are required:

Object	Attributes
PerPerson	PersonIdExternal DateOfBirth
homeAddressNavDEFLT	Country ZipCode State Address1 City
EmploymentNav	IsContigentWorker LastDayWorked OriginalStartDate
JobInfoNav	Department Division SeqNumber ManagerId CostCenter StartDate EndDate JobCode JobTitle WorkLocation WorkingDaysPerWeek BusinessUnit IsFulLTimeEmployee
CompanyNav	Name_en_US
CostCenterNav	CostCenterDescription
EmployeeStatusNav	Status
PersonalInfoNav	FirstName LastName MiddleName Gender
PhoneNav	PerPhone.PhoneNumber PerPhone.Primary
EmailNav	emailNav.Primary emailNav.Value
StateNav	ExternalCode
User	Custom01
EmpInfo
PersonNav
PositionNav	Code externalName_Localized

Procedure

Step 1 – Generate a self-signed certificate in EmpowerID

Expand Apps and Authentication > SSO Connections on the EmpowerID Web interface's navbar and select SSO Components.
Select the Certificates tab and click the Add button in the grid header.
Image Added
Select Generate Self-Signed Certificate.
Image Added
Enter the following information:
- Certificate Owner – Leave empty
- Prefer Local Machine Store – Leave empty
- Subject Name – Enter something suitable to the purpose of the certificate, such as CN=AzureCertificate
- Requires Password – Select this option; this adds a private key to the certificate
- Certificate Password – Enter a password for the certificate
Click Save to create the certificate.
Image Added

Step 2 – Download the certificate in Base64 format

From the Certificate Details page, return to the SSO Components page by clicking the Find Certificates breadcrumb.
On the SSO Components page, select the Certificates tab and search for the certificate you just created.
Image Added
Click the Name link for the certificate to navigate to the View page for the certificate.
On the View page for the certificate, click Export Certificate.
Image Added
Select the desired location to save the certificate and click Save.

Step 3 – Register a service principal application in Entra ID

Log in to your Azure portal as a user with the necessary permissions to create an application in Entra ID.
In Azure, navigate to your Microsoft Entra ID.
Navigate to Manage > App registrations and click New registration.
Image Added
Name the application, select the scope for the application (single or multitenant), and click Register.
Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used when configuring the SCIM app service.
Image Added
Navigate to the Certificates & secrets blade for the application and click Upload certificate.
Image Added
Select the base-64 encoded certificate you downloaded from EmpowerID and click Add.
Image Added

Note
The public key certificate that you upload to Azure must have a corresponding private key in the EmpowerID certificate store; otherwise, an error will occur when calling Azure’s API.

Step 4 – Create an app service to host the SuccessFactors SCIM microservice

Log in to your Azure portal as a user with the necessary permissions to create an App Service.
In Azure, navigate to All Services > App Services and create a new App service.
Under Project Details, select a Subscription and then create a Resource Group for the App Service.
Under Instance Details, do the following:
- Name – Enter a name.
- Publish – Select Code.
- Runtime Stack – Select .Net Core 8.
- Operating System – Select Linux.
- Region – Select the appropriate region.
Click Review + Create.
Click Create.
After the deployment of the app service completes, click Go to resource.
Change the platform for the app service to 64 Bit by doing the following:
1. On the app service navbar, under Settings, click Configuration.
2. On the Configuration blade, select the General settings tab.
3. Under Platform settings, change the Platform to 64 Bit and click Save.
4. Click Continue to confirm you want to save the changes.
Copy and save the URL on the app service's overview page. You will need it when configuring Entra ID Auth for the app service.
Image Added

Step 5 – Configure authentication for the app service

Navigate to Settings > Authentication and click Add identity provider.
Image Added
Select Microsoft.
Image Added
Add the following identity provider information:
1. Choose a tenant for your application and its users – Select Workforce configuration (current tenant)
2. App registration type – Select Pick an existing app registration in this directory.
3. Name or app ID – Select the service principal application you created to provide Entra ID authentication for the microservice.
4. Issuer URL – Replace the default value with https://login.microsoftonline.com/<Your Tenant ID>
5. Client application requirement – Select Allow requests only from this application itself
6. Identity Requirement – Select Allow requests from any identity
7. Tenant requirement – Select Allow requests from specific tenants
  - Allowed tenants – Ensure the Tenant ID matches the specific tenant
8. Restrict access – Select Require authentication.
9. Unauthenticated requests – Select HTTP 401 Unauthorized: recommended for APIs.
10. Token Store – Leave selected.
11. Click Add.
  Image Added
After adding the Identity provider, click the Edit link.
Image Added
Set the Issuer URL to https://login.microsoftonline.com/<Your Tenant ID>.
Under Allowed token audiences, enter the URL for the app service.
Click Save.
Image Added
Under Settings, select Identity.
Turn on system assigned managed identity and click Save.
Image Added
Click Yes to confirm you want to enable system assigned managed identity and register the App Service with Azure Active Directory.
Image Added
Go to the App Service Overview page andclick Download publish profile. You will need this file when you publish the SuccessFactors microservice to Azure.
Image Added

Step 6 – Publish the SuccessFactors Microservice to Azure

Note
Prior to publishing the microservice, you will need to obtain the appropriate ZIP file from EmpowerID.

Copy the below PowerShell script into the text editor of your choice and save it as zipdeploy_appService.ps1.

Code Block

param(
    $pubProfileFilePath
    ,$zipFilePath
)
$ErrorActionPreference = "Stop"
$pubProfile = [xml](gc $pubProfileFilePath)
$zipPubProfile = $pubProfile.publishData.publishProfile | where { $_.publishMethod -eq "zipdeploy" }
$userAgent = "powershell/1.0"
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $zipPubProfile.userName, $zipPubProfile.userPWD)))
$zipdeployUrl = "https://$($zipPubProfile.publishUrl)/api/zipdeploy"
$deploymentsUrl = "https://$($zipPubProfile.publishUrl)/api/deployments"
Invoke-RestMethod -Uri $zipdeployUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Post -InFile $zipFilePath
Invoke-RestMethod -Uri $deploymentsUrl -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -UserAgent $userAgent -Method Get

Open an administrative PowerShell session.
Navigate to the directory where you saved the script and execute the script, passing in the values of the pubProfilePath and zipFilePath parameters via the command line, where the value of pubProfilePath is the path to the SuccessFactors App Service Publisher Profile Settings file you downloaded from Azure, and the value of zipFilePath is the path to the microservice ZIP file you received from EmpowerID.
The command to execute the script should look similar to that shown in the below image.
Image Added

Step 7 – Create an account store for SuccessFactors

On the navbar, expand Admin > Applications and Directories and select Account Stores and Systems.
Select the Actions tab and then click Create Account Store.
Image Added
Under System Types, search for Success Factor Scim.
Click the record for Success Factor Scim Connector to select the type and then click Submit.

Image Added

This opens the SuccessFactors SCIM form.
Image Added
Enter the following information in the SuccessFactors SCIM form:
- Account Store Name – Name of the account store
- App Service Base URL – The URL to the app service hosting the SuccessFactors SCIM microservice
- User Name – The username for the SuccessFactors API user
- Password – The password for the SuccessFactors API user
- Company ID – The Company ID for SuccessFactors, e.g. SFEDU0323232
- Microservice Base URL – The URL for the SCIM Microservice deployed in the Azure tenant
- Azure App ID – The Client ID / Application ID for SCIM Microservice deployed in the Azure Tenant
- Azure Directory (Tenant ID) – The TenantID in which the SCIM Microservice is Deployed
- Certificate Thumbprint – The thumbprint of the certificate used in Azure for authentication
When ready, click Submit to create the account store.

Step 8 – Verify resource system parameters

Return to the Find Account Stores page and search for the SuccessFactors account store you just created.
Click the Account Store link.
Select the Resource System tab and then expand the Configuration Parameters accordion at the bottom of the page.
Image Added
Verify the following parameters have the correct value. These values were added to the form when the account store was created.
- AzureAppID – The Client ID / Application ID for SCIM Microservice deployed in the Azure Tenant
- AzureTenantID – The TenantID in which the SCIM Microservice is Deployed
- certificateThumbprint – The thumbprint of the certificate used in Azure for authentication
- ServiceUrl – The URL for the SCIM Microservice deployed in the Azure tenant
- SFBaseURL – The base URL for calling SuccessFactor’s API
- SFCompanyId – The Company ID for SuccessFactors
- SFUsername – The username for the SuccessFactors API user

Step 9 – Configure Attribute Flow

On the Account Store Details page for the Workday account store, select the Attribute Flow Rules tab.
Review the attribute flow and revise as needed. EmpowerID translates the attributes in Workday to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in Workday flow to the EmpowerID Person, as well as any other user accounts owned by the Person.
To change the score for any of the available CRUD operations (Create, Update and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

Step 10 – Create Dynamic Hierarchy policies to generate roles and location (Optional)

If desired, you can use Dynamic Hierarchy policies to generate external roles and locations based on specific user attributes, such as Job Title and Department. The external roles and locations can then be used to map corresponding EmpowerID logical locations. Please see Use Dynamic Hierarchy Policies to Create External Roles and Locations for information on setting this up. When completed, return to this article and complete steps 10 and 11.

Step 11 – Configure the SuccessFactors account store

Click the Edit link on the Account Store Details page for the SuccessFactors account store to put the account store in Edit mode.
Edit the settings shown below as needed and save your changes.

Account Store Settings

Setting

Description

Authentication and Password Settings

Password Manager Policy for Accounts without Person

Specifies the Password Manager Policy to be used for user accounts not joined to an EmpowerID Person.

Provisioning Settings

Allow Person Provisioning (Joiner Source)

Specifies whether EmpowerID Persons can be provisioned from user accounts in the account store.

Allow Attribute Flow

Specifies whether attribute changes should flow between the account store and EmpowerID.

Allow Provisioning (By RET)

Allows or disallows the Resource Entitlement (RET) Inbox process to auto-provision accounts for this domain for users who receive RET policy-assigned user accounts, but have not yet had them provisioned.

Allow Deprovisioning (By RET)

Allows or disallows the Resource Entitlement Inbox process to auto de-provision accounts for this domain for users who still have RET policy-assigned user accounts, but no longer receive a policy that grants them a user account in the domain. De-provisioning only occurs if the de-provision action on the Resource Entitlement policy is set to De-Provision.

Max Accounts per Person

This specifies the maximum number of user accounts from this domain that an EmpowerID Person can have linked to them. This prevents the possibility of a runaway error caused by a wrongly configured Join rule. It is recommended that this value be set to 1 unless users will have more than 1 account and you wish them to be joined to the same person.

Business Role Settings

Allow Business Role and Location Re-Evaluation

Specifies whether Business Role and Location re-evaluation should occur for the account store

Business Role and Location Re-Evaluation Order

This is an optional policy setting that can be used by provisioning workflows to determine which Account Store has priority when determining the roles and locations that should be assigned to a person. Account Stores with a higher value take precedence.

Inventory Auto Provision OUs as IT System Locations

Specifies whether OUs in the external system are added as IT System locations in EmpowerID. If true, the OUs appear under the All IT Systems location node.

Inventory Auto Provision External Roles as Business Roles

Specifies whether EmpowerID should provision Business roles for external account store roles

Note
If you are using Dynamic Hierarchy policies to generate custom external roles and locations, this options should be left disabled.

Default Person Business Role

Specifies the default EmpowerID Business Role to be assigned to each EmpowerID Person provisioned from the user accounts in the account store.

Default Person Location (leave blank to use account container)

Specifies the default EmpowerID Location to be assigned to each EmpowerID Person provisioned from the user accounts in the account store.

Special Use Settings

Automatically Join Account to a Person on Inventory (Skip Account Inbox)

Specifies whether EmpowerID should attempt to join user accounts in the account store to an existing EmpowerID Person during the inventory process. When enabled, the Account Inbox is bypassed.

Automatically Create a Person on Inventory (Skip Account Inbox)

Specifies whether EmpowerID should create new EmpowerID Persons from the user accounts discovered in the account store during the inventory process. When enabled, the Account Inbox is bypassed.

Inventory Settings

Inventory Schedule Interval

Specifies the time span that occurs before EmpowerID performs a complete inventory of the account store. The default value is 10 minutes.

Inventory Enabled

Allows EmpowerID to inventory the user information in the account store.

Step 12 – Enable Inventory on the account store

On the Account Store Settings page, select the Inventory tab.
Under Change the Inventory Schedule Interval , do the following:
1. Optionally, select a Start and End date for inventory to occur
2. Select Hour Interval
3. Interval – Enter either 12 or 24.
Inventory Enabled – Toggle to enable EmpowerID to inventory Workdayas needed. By default, EmpowerID inventories account stores once every 10 minutes.
Toggle Inventory Enabled.
Click Save to save your changes to the account store.

Now that inventory is enabled for the account store, the next step is to turn on the Account Inbox permanent workflow. This workflow is responsible for fetching and processing new user accounts.

Step

12
13 – Enable the Account Inbox Permanent Workflow
Insert excerptIL:Enable Account Inbox PW - V21IL:Enable Account Inbox PW - V21nopaneltrueStep 13
On the navbar, expand Infrastructure Admin > EmpowerID Server and Settings and select Permanent Workflows.
On the Permanent Workflows page, click the Display Name link for Account Inbox.
On the Permanent Workflow Details page that appears, click the pencil icon to put the workflow in edit mode.
Check Enabled.
Click Save to save your changes.
Step 14 - Map Role and Locations
On the navbar, expand Identity Lifecycle and select Role and Location Mapper.
Select the Role Mapper tab.
In the External Source Business Role pane of the Role Mapper tab, do the following:
In the first (upper) field - Search for and select the external directory containing the role you want to map, and
In the second (lower) field - Enter the name of the external role you want to map and press ENTER to load the role.
Select the role from the tree.
Select the Location Mapper tab.
In the External Source Location pane of the Location Mapper tab, do the following:
In the first (upper) field - Search for and select the external directory containing the location you want to map and
In the second (lower) field - Enter the name of the external location you want to map and press ENTER to load the location.
Select the location from the tree.
Image RemovedImage Added

In the Internal Destination Location pane, enter the name of the EmpowerID location to which you want to map the external directory location and then select the location from the tree.
Image RemovedImage Added

Click Save to save the mapping.
Repeat for any other mappings you wish to create.
Info
If you select an external role or an external location that is a parent role or location, the children of that role or location will be mapped to the selected EmpowerID location.

Macrosuite divider macro
dividerWidth 80
dividerType text-with-icon
emoji {"id":"smile","name":"Smiling Face with Open Mouth and Smiling Eyes","short_names":["smile"],"colons":":smile:","emoticons":["C:","c:",":D",":-D"],"unified":"1f604","skin":null,"native":"😄"}
textColor #000000
dividerWeight 3
labelPosition middle
textAlignment center
iconColor #0052CC
fontSize medium
text Related
emojiEnabled false
dividerColor #DFE1E6
dividerIcon bootstrap/CloudsFill
Use Dynamic Hierarchy Policies to Create External Roles and Locations
Insert excerpt
IL:External Stylesheet
IL:External Stylesheet
nopanel true

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Div

style	float:left; position:fixed;
id	articleNav

IN THIS ARTICLE

Table of Contents

maxLevel	4
minLevel	2
style	none
printable	false

Insert excerpt

	IL:External Stylesheet
	IL:External Stylesheet
nopanel	true

Versions Compared

Old Version 1

New Version Current

Key

Step 1 – Generate a self-signed certificate in EmpowerID

Step 2 – Download the certificate in Base64 format

Step 3 – Register a service principal application in Azure

Step 4 – Create an app service to host the Workday SCIM microservice

Step 5 – Configure authentication for the app service

Step 4 – Publish the Workday Microservice to Azure

Step 5 – Create a key vault with secrets to store Workday credentials

Step 6 – Create an account store for Workday

Step 7 – Verify Workday resource system parameters

Step 8 – Configure Attribute Flow

Step 9 – Create Dynamic Hierarchy policies to generate roles and location (Optional)

Step 10 – Configure the Workday account store

Step 11 – Enable Inventory on the account store

Prerequisites

Procedure

Step 1 – Generate a self-signed certificate in EmpowerID

Step 2 – Download the certificate in Base64 format

Step 3 – Register a service principal application in Entra ID

Step 4 – Create an app service to host the SuccessFactors SCIM microservice

Step 5 – Configure authentication for the app service

Step 6 – Publish the SuccessFactors Microservice to Azure

Step 7 – Create an account store for SuccessFactors

Step 8 – Verify resource system parameters

Step 9 – Configure Attribute Flow

Step 10 – Create Dynamic Hierarchy policies to generate roles and location (Optional)

Step 11 – Configure the SuccessFactors account store

Step 12 – Enable Inventory on the account store

Step

13 – Enable the Account Inbox Permanent Workflow

Step 14 - Map Role and Locations