In today’s enterprise landscape, where secure and scalable access to digital tools is more important than ever, Single Sign-On (SSO) plays a vital role in managing user identities and permissions. Workday, widely used for Human Capital and Financial Management, is a key system that employees rely on daily. By connecting Workday with an SSO provider like Okta, organizations can offer their teams a smoother, more secure login experience.
In this blog, we’ll walk through how SSO works with Workday, highlight the benefits it brings, guide you through the integration process with Okta step by step, and share some best practices for a secure and dependable setup.
Single Sign-On (SSO) is a login approach that lets users sign in just once to access a range of applications without needing to re-enter their credentials each time. For organizations, this reduces the hassle of managing multiple passwords, cuts down on security risks like password reuse, and helps employees work more efficiently.
In the case of Workday, SSO allows users to log in through their company’s central identity provider, such as Okta, making it easier and more secure to access important HR and financial information.
In a Single Sign-On setup, Workday functions as a Service Provider (SP), relying on an external Identity Provider (IdP) like Okta to handle user authentication. It uses the SAML 2.0 (Security Assertion Markup Language) protocol, an industry-standard method for securely exchanging authentication and authorization data between systems.
Here’s how the process typically works:
The SSO login link for Workday usually follows this structure:
https://www.myworkday.com/[tenant]/login-saml.htm
Today, we will set up Single Sign-On (SSO) integration for Workday. Our identity provider for this integration will be Okta. This setup will enable seamless and secure access to Workday via Okta.
Follow the steps below to configure Single Sign-On (SSO) in Workday using Okta as the Identity Provider (IdP).
Login Redirect URL:
Your Tenant URL]/login-saml2.flex e.g, https://impl.workday.com/xme/login-saml2.flex
Logout Redirect URL:
Mobile App Login Redirect URL:
[Your Tenant URL]/login-saml2.flex e.g, https://impl.workday.com/xme/login-saml2.flex
Mobile Browser Login Redirect URL:
[Your Tenant URL]/login-saml2.flex e.g, https://impl.workday.com/xme/login-saml2.flex
The Single Sign-On settings screen in Workday displays fields to input redirect URLs, with a table below showing redirect types and environment-specific dropdowns.
The SAML Setup section in Workday with the "Enable SAML Authentication" checkbox is selected to activate Single Sign-On using SAML.
Identity Provider Name: Enter Okta
Issuer: Obtain this from your Okta Admin Dashboard under the Workday app's SAML settings.
The SAML Setup section lists multiple identity providers, including "Okta," with fields for Identity Provider Name, Issuer, and Certificate completed for each entry.
x509 Certificate:
The "Create x509 Public Key" dialog with fields for Name, Valid From, Valid To, and Certificate to input and save a new x509 certificate for SAML authentication.
IdP SSO Service URL:
SAML Identity Providers table displaying settings to enable Workday Initiated Logout, including fields for Logout Request URL and IdP SSO Service URL.
Workday interface for generating an x509 Private Key Pair with input fields for key name, description, and a setting to prevent regeneration.
SAML Identity Provider settings table in Workday, with checkboxes for enabling Workday Initiated Logout, SP Initiated Authentication, and other options across multiple entries.
SAML authentication settings in Workday with "Always Require IdP Authentication," "ForceAuth Only," and "SHA256" selected for the Authentication Request Signature Method, ready to save.
The "View x509 Private Key Pair" section displays the public key details, including the certificate content, RSA-SSH formatted key, and validity period.
View of the Okta Workday app settings under the "Sign On" tab, showing options to enable Single Logout, disable Force Authentication, and upload a signature certificate using Browse and Upload buttons.
You’ve now successfully set up SSO integration between Workday and Okta. Ensure testing is done for both web and mobile access paths, and validate SSO and logout behaviors thoroughly before rolling out to users.
Gal is the Cofounder & CPO of Reco. Gal is a former Lieutenant Colonel in the Israeli Prime Minister's Office. He is a tech enthusiast, with a background of Security Researcher and Hacker. Gal has led teams in multiple cybersecurity areas with an expertise in the human element.
Integrating Workday with Okta for SSO is not just a technical step—it’s a strategic initiative that enhances both security and user experience. Rather than treating it as a one-time setup, organizations should align it with their broader identity and access management (IAM) policies.
Experts emphasize focusing on the following:
Go beyond default settings to enable:
Integrate SSO logs into your incident response plan. Leverage:
These practices will improve visibility, support root-cause analysis, and strengthen your organization’s compliance posture.
Workday SSO integration with Okta is a strategic move toward secure and simplified enterprise access management. By leveraging SAML 2.0, organizations can centralize authentication without compromising user experience or system integrity.
Whether you're a security admin, Workday consultant, or IT manager, mastering the steps to implement Workday SSO with Okta empowers you to deliver a more secure, efficient, and modern authentication experience across your organization.
.svg)
.svg)
