TABLE OF CONTENTS

• Enabling HRIS the HRIS Connector
• Create Connection
• Select HRIS Provider
• HRIS Standard Fields
• HRIS Custom Fields
• HRIS Integration - Testing and Demo Accounts
• Multiple Connectors - Removing Connectors
• Specific HRIS Instructions
  • ADP Workforce Now
  • BambooHR
  • UKG Pro
  • Workday
• FAQs

WorkTango has partnered with data integration connector Merge for our HRIS connections because of the volume and speed at which their platform and development teams move to add new integrations across different categories. 

With just a few, clicks we are now able to seamlessly authorize HRIS platform data into our product, saving customers time and any potential headache when sharing data between these two systems.

WorkTango now supports 43 HRIS integrations with the ability to map and import custom fields.

We can automatically map all standard fields required for implementation with WorkTango. The setup is very simple and can be completed in minutes.

If desired, we can also map custom fields from the HRIS platform to several items with WorkTango.  Fields within the customers HRIS platform can become:

• Attributes

• Groups

• Point Rules

Enabling HRIS the HRIS Connector

To enable our HRIS connector you must be on our modern user management solution.  Please reach out to our customer support team so they can confirm you are on the newest tool set, and so they can enable the product in your WorkTango instance. If you are not on the newest toolset, our team can help manage your upgrade as well.

Create Connection

1. Go to Admin > Recognition & Rewards > Integrations > Merge

2. Click Add new connection  

Best Practice

All connectors should be setup with a member of the Customer Success team and a customer with Administrator access to their HRIS provider 

Select HRIS Provider

Configure Integrations

1. The administrator making the connection in the WorkTango platform must also be a full rights administrator in the HRIS platform they are connecting to.  If the administrator is not IT savy, it may be best to have them ride along an IT resource to the call, especially if the connector requires API credentials.

   1. The user creating the integration needs to have both full Admin access to WorkTango, and the HRIS system.  They may need to enable the IT access person Administrator rights to WorkTango as part of the implementation.  This can be removed after the fact.

2. When you’re ready to begin integrating, search or choose a connector from the Merge 

3. Once selected, click continue to preview the steps or information needed to complete the integration

   1. It is important to review configuration documentation prior to starting.  Merge has documentation per connector on their website, and we have included individual instructions for the most popular HRIS solutions below in this document. That includes resources for ADP Workforce Now, UKG Read, and Workday

   2. All HRIS Authentication Guides: HRIS | Merge Help Center  

Best Practice

Read ours or Merge’s integration material for specific HRIS system prior to configuration.  Every HRIS provider is different.  Some providers (like ADP) may require the customer to complete additional steps on their own to enable the connection.

HRIS Standard Fields

By default we integrate the following standard fields as part of our integration.  This sets a baseline for the data we need in our platform to enable your employees, insights, and rewards experiences.  This data comes over automatically and does not need to be mapped in any way.

Employee Data 

• Company

• Date of birth

• Display full name

• Employee number

• Employments

• Ethnicity

• First Name

• Gender

• Groups

• Home location

• Last Name

• Manager

• Marital status

• Mobile phone number

• Personal email

• Preferred name

• Remove created timestamp

• Start date

• Termination date

• Username

• Work email

• Work location

Employments

• Effective date

• Employee

• Employment type

• Job title

• Pay currency

• Pay frequency

• Pay period

• Pay rate

Companies

• Display name

• Employer identification number

• Legal name

Groups

• Name

• Type

Locations

• City 

• Country

• Location Type

• Name

• Phone number

• State

• Street 1

• Street 2 

• Zip code

Override a standard field

WorkTango has the ability to override a standard field mapping with a custom field mapping.  This configuration cannot be done through the interface, and must be completed by a WorkTango team member.  Please reach out to your customer support representative for additional details.

HRIS Custom Fields

Custom fields are only used to map Point Rules, Attributes, and Group data.  You should not map the  standard fields listed above as any of the custom fields below.

Point Rule

Create your points rule and associated values in WorkTango before beginning this step. 

1. Create a Merge customization for Point Rules by choosing Map Field during Add Connection step or Manage Connection. 

2. Click Map Field 

3. You’ll see pointRule as a possible connection. 

4. Type in the Field the customer has identified for their Points Rule assignment (this could be an existing field they have repurposed or a customized field in their HRIS)

5. In order to successfully assign the point rule, the values in that field must exactly align to the Points Rules created in the UI in WorkTango
   
   

Some HRIS systems (BambooHR as an example) don’t allow customers to create custom fields.  If you want to repurpose an existing field in their HRIS to store custom point rules, they can do this, and import data from that field.  

Custom Attributes 

Create your attributes in WorkTango before beginning this step. 

1. Create a Merge customization for Attributes by choosing Map Field during Add Connection step or Manage Connection. 

2. Click Map Field 

3. Click + Field Mapping

   1. Select the data model for your target field: Employee 

   2. Name your target field: Enter the name of the Attribute(s) you have created 

   3. Describe your target field: Optional

   4. Click Next 

4. Select the {HRIS Provider} field to sync data from: 

5. Type in the search box to select the field from the Customer HRIS and select 

6. Click Save 

7. Click Save Mappings > Finish Setup 

Custom Groups

Create a customization for Groups by choosing Map Field during Add Connection step or Manage Connection.

1. Click Map Field 

2. Click + Field Mapping

   1. Select the data model for your target field: Employee 

   2. Name your target field: Enter the name of the custom group with “group_” (e.g. group_scrum_team)  

   3. Describe your target field: Optional

   4. Click Next 

3. Select the {HRIS Provider} field to sync data from: 

   1. Type in the search box to select the field from the Customer HRIS and select 

   2. Click Save 

4. Click Save Mappings > Finish Setup 

After creation, this Custom Group cannot be edited. It can only be deleted. If you need to make an edit, you need to delete the mapping and recreate it as new. 

Private Groups need to be manually created in the platform prior to being imported. 

Delete Custom Mappings

To delete a field mapping, an authorized user needs to log into Merge. 

1. Go to Linked Accounts > Select the Account 

2. Go to Field Mapping > Employee custom fields 

3. Click the ellipses and Delete Mapping 

HRIS Integration - Testing and Demo Accounts

CS Demo to HRIS product accounts only

1. You can set up a test account between CS Demo and the your production HRIS.

2. You cannot set up a demo account to a sandbox HRIS account

Test accounts are not intended to be left connected. You will need to delete the connector after test is complete.

ADP Workforce Now will not allow multiple or test connections.  You can only set up a single production account for that provider.

Multiple Connectors - Removing Connectors

Multiple Connectors

You can configure multiple HRIS connections to one WorkTango instance.  The first connector is included as part of your subscription pricing.  Adding additional connectors will result in a $500 annual fee per connector. 

Specific HRIS Instructions

The following instructions are for our most frequently connected HRIS systems.  More information for managing connections can be found on our integration providers website.

ADP Workforce Now

https://help.merge.dev/en/articles/6610852-adp-workforce-now-partner-authentication

Step 1: Get Started

1. Select "ADP" in the Linking Flow. You will see a token that will be used in the next steps.

2. Copy the token presented in the Linking Flow screen. DO NOT close this pop up window.

Step 2: Logging into ADP to add the token

1. Log into your ADP WorkForce Now account in a separate tab and navigate to the ADP Marketplace. You will be navigating back and forth between these two tabs throughout this process.

2. Once logged into ADP, find the data-connector app that belongs to the business you are integrating within the ADP Marketplace and click "Buy Now". If you have our legacy connector enabled you will need to unsubscribe from that connector before purchasing the new connector.    

3. When prompted for a token in the ADP Marketplace flow, input the value you copied from the popup in Step 1. 

4. Finish the ADP Marketplace Subscription flow, and return back to the original linking flow screen from Step 1 to complete the rest of the linking process. 

5. A "Next Step" button should now appear clickable in the original popup window. Click this button to go to the next step. 

Step 3: Providing Consent in ADP

1. Back in ADP, navigate to the "My Apps" section in ADP's Marketplace, and click on the data connector app from earlier. 

2. You will be prompted to provide consent to the access of data. If it does not prompt you, you likely have already consented to the business you're integrating with, and you can skip this step.

Step 4: Connect the Integration

1. Navigate back to the original linking popup window and click “I have provided consent” after providing consent in ADP’s Marketplace.

 Your account is now linked, and the initial sync of the ADP account data has begun!

BambooHR

https://help.merge.dev/en/articles/6597267-bamboohr-oauth-authentication 

Step 1: Get Started

1. Select "Bamboo" in the Linking Flow. 

2. Add in your subdomain for your BambooHR Account to Merge Link.

3. You will be redirected to BambooHR to log in to your account. 

Step 2: Enter your BambooHR account credentials.

1. Once entered, your Authentication is complete!

UKG Pro

https://help.merge.dev/en/articles/5696209-ukg-pro-service-user-basic-auth

Step One: Find your UKG Pro Customer API Key.

1. You'll want to login to your UKG Pro account and search Service Account Administration in your search bar on the top right.

2. Copy the Customer API Key from under the header.

3.) Open the Integration interface in WorkTango

1. Search and select UKG

2. Paste the Customer API Key in Merge Link.

Step Two: Create your Service Account

1.) On the UKG Pro Service Account Administration Page, click on "+ add" in the upper right hand side.

2.) Enter in the admin of your UKG Pro account's username and email. You will need the username later.

3.) Scroll down under Web Service to enable permissions.

View Employee Person Details is the minimum requirement to authenticate your account with Merge. 

Depending on the use case, you may be required to add some, or all, of these permissions:

• Employee Pay Statement
• Employee Employment Information
• PTO Plan Integration
• Company Configuration Integration
• Payroll Integration
• Personnel Integration
• Employee Job History Details
• Employee Person Details
• Employee Compensation Details

4.) Click Save. Your new password will pop up. Save the password in a secure location.

5.) Enter your UKG Pro service account credentials in Merge Link and click Submit.

This should be the user name of your admin service user and the password you just generated.

Step Three: Finding your UKG Web Service Domain.

1.) In your search bar, search for Web Services.

2.) Look at any of the "web service endpoint URLs" and find your subdomain.

For example if your URL is, http://Servicet.ultipro.com/services/BIDataService then your subdomain is "Servicet". 

3.) Find your top-level domain.

For example if your URL is, http://Servicet.ultipro.com/services/BIDataService then your top level domain is "ultipro.com". 

Step Four: Complete Merge Link

On the "Enter your UKG Pro Web Services URL (Part 1) screen, enter your subdomain.

Click Submit. On the "Enter your UKG Pro Web Services URL (Part 2)" screen, select the URL that matches your top level domain.

Workday

https://help.merge.dev/en/articles/5699428-workday-isu-and-web-services-endpoint-authentication

Before linking your Workday, we'll need to make sure that the correct permissions are enabled. Below are some detailed steps for granting permissions. Steps One through Five are done within your Workday portal, whereas the last step is done on your Merge Link prompt.

Step One: Create an Integration System User (ISU)

1. In your Workday portal, log into the Workday tenant.

2. In the Search field, type Create Integration System User.

3. Select the Create Integration System User task.

4. On the Create Integration System User page, in the Account Information section, enter a user name, and enter and confirm a password.

5. Click OK.

Note: due to xml encoding, "&", "<", and ">" cannot be included in the password.

Note: Ensure Require New Password at Next Sign In is NOT checked. 

Note: You'll want to add this user to the list of System Users to make sure the password doesn't expire.

Step Two: Create a Security Group and Assign an Integration System User

Now, add this Integration System User to a Security Group:

1. In the Search field, type Create Security Group.

2. Select the Create Security Group task.

3. Click OK.

4. On the Create Security Group page, from the Type of Tenanted Security Group pull-down menu, select Integration System Security Group (Unconstrained).

5. In the Name field, enter a name.

6. Click OK.

7. On the Edit Integration System Security Group (Unconstrained) page, in the Name field, enter the same name you entered when creating the ISU in the first section.

8. Click OK.

Step Three: Configure Domain Security Policy Permissions

1. In the Search field, type Maintain Permissions for Security Group

2. Make sure the Operation is Maintain, and the Source Security Group is the same as the security group that was assigned in Step 2. 

3. Add the corresponding Domain Security Policy with GET operation:

Please note the permissions listed below are the required permissions for the full HRIS API. Permissions can differ from implementation to implementation.

For a more detailed breakdown of the functional areas that are needed: here

Step Four: Activate Security Policy Changes  

1. In the search bar, type "Activate Pending Security Policy Changes" to view a summary of the changes in the security policy that needs to be approved. 

2. Add any relevant comments on the window that pops up

3. Confirm the changes in order to accept the changes that are being made. 

Step Five: Validate Authentication Policy is Sufficient

Check the Manage Authentication Policies section to ensure the ISU you created is added to a policy that can access the necessary domains. It should not be restricted to only the "SAML" Allowed Authentication Types – if this is the case, you can create a new Authentication Policy with a "User Name Password" Allowed Authentication Type.

1. Editing Authentication Policies 

2. Create an Authentication Rule, and add the Security Group to the Rule

3. Make sure the Allowed Authentication Types is set to specific User Name Password or set to Any

Step Six: Activate All Pending Authentication Policy Changes

1. In the search bar type, Activate All Pending Authentication Policy Changes

2. Proceed to the next screen, and confirm the changes. This will save the Authentication Policy that was just created.

Step Seven: Obtain the Web Services Endpoint for Workday Tenant

We'll need access to your specific Workday web services endpoint:

1. Search in Workday for Public Web Services.

2. Open Public Web Services Report.

3. Hover over Human resources and click the three dots to access the menu.

4. If you are integrating with your Workday ATS, please find Recruiting instead and access that menu.

5. Click Web Services > View WSDL.

6. Navigate to the bottom of the page that opens and you'll find the host.

7. Copy everything until you see /service. This should look something like https://wd5-services1.myworkday.com/ccx.

Enter Credentials into Merge Link

1. Open the Integration interface in WorkTango

2. Search and select Workday

3. Workday URL: Enter the Web Services Endpoint you found from Step 5 into Merge Link.

4. User ID: Enter the Integration System User name for the user created in Step One.

5. Password: Enter the Integration System User password for the user created in Step One.

6. Workday Tenant Name: Enter your Workday Tenant name.

7. Example: If you sign in at "https://wd5-services1.workday.com/acme", enter "acme".

Notes:

• Linked Implementation Workday accounts will result in slower syncs as there are fewer resources dedicated to the tenant. 

• The password used cannot contain an "&" or "<", ">" signs.

• Please make sure to exempt the ISU Account from MFA and SSO

FAQs

Can an HRIS only send a portion of their population via this connection? 

At this time, our connectors are only capable of ingesting all available users from an HRIS provider.  Depending on your HRIS provider you may be able to create an administrator account that has access to a sub-set of your users.  Using this account to sync data to the platform will only bring in that sub-set.  Please reach out to your HRIS provider to see if this functionality is available for your use.

Can I connect multiple HRIS systems to WorkTango?

You can configure multiple HRIS connections to one WorkTango instance.  The first connector is included as part of your subscription pricing.  Adding additional connectors costs $500 per year.

Will my HRIS charge any fees for this connection?

That is different for every HRIS system.  Some providers may have a cost associated with generating an API key or enabling integrations. Using ADP for example requires you to subscribe to our connector through their marketplace, and has an additional fee of $300 per year.  

How do we delete a connector? 

There is a button available to delete connectors.

How long does it take to setup a connector?

This tool should provider a one-call effort for the customer and Implementation team to setup the HRIS connection. This will be a very impactful reduction to implementation timelines and, ideally, eliminate a lot of back and forth between WorkTango resources and your internal resources. 

Who on the customer team can set up the Merge connectors?

The customer Admin of WorkTango must ALSO be a Full Administrator of the HRIS system they are trying to link up to WorkTango.

 How does our HRIS integration security work?

Please look at our providers details here: Trust Center  

Can you support an HRIS connector and SFTP at the same time?

Yes.  Please work with our team to make sure your import settings are correctly configured to hande this implementation.