SaaS Security Administrator's Guide
    : Begin Scanning a Workday App (Beta)
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. Data Security
    5. Secure Sanctioned SaaS Apps on Data Security
    6. Add Cloud Apps to Data Security
    7. Begin Scanning a Workday App (Beta)
    Download PDF

    SaaS Security Administrator's Guide

    Begin Scanning a Workday App (Beta)

    Table of Contents

    Begin Scanning a Workday App (Beta)

    Add your Workday app to
    Data Security
     to begin scanning and monitoring assets for possible security risks.
    To connect a Workday app to
    Data Security
     and begin monitoring activities, you need to:
    • Have an admin account with the required privileges.
    • Create the required User, Roles, and REST client for
      Strata Cloud Manager
       to monitor Workday activity.
    • Grant Workday API access to
      Data Security
      .
    Currently,
    Data Security
     for Workday supports monitoring user activities only.
    Support for automated remediation capabilities varies by SaaS application.

    Prepare to Add Workday App

    1. Edit Tenant Setup - System
      1. Log in to
        Workday Console
         as a Workday Admin and search for
        Edit Tenant Setup - System
        .
      2. Under User Activity Logging, select
        Enable User Activity Logging
    2. Create Integration User
      1. Log in to
        Workday Console
         as a Workday Admin and search for
        Create Integration System User
        .
      2. Enter a user name and password. Ensure that
        Do Not Allow UI Sessions
         is
        not
         selected to allow first time sign-in while granting access. The check box can be disabled later after granting
        Strata Cloud Manager
         permission for accessing Workday.
      3. Click
        OK
         and then
        Done
        .
    3. Create Security Group
      1. Search for
        Create Security Group
        .
      2. In
        Create Security Group
        , for
        Type of Tenanted Security Group
        , select
        Integration System Security Group (Unconstrained)
         from the drop-down and enter a security group name.
      3. Click
        OK
        .
      4. On the
        Edit Security Group
         page, choose the system integration user you created earlier for Integration System User.
      5. Click
        OK
         and then
        Done
        .
      6. Search for
        View Domain
        and select
        System Auditing
        .
      7. Go to
        Actions (…)
        Domain
        Edit Security Policy Permissions
        .
      8. Under
        Report/Task
         permissions, search for the security group created earlier and select the
        View
         check box.
      9. Under
        Integration
         permissions, search for the security group created earlier and select the
        Get
         check box.
      10. Click
        OK
        .
        You can safely ignore alerts about activating pending security policy changes. Activate them after completing the following step.
      11. Search for the following domains under
        View Domain
         and repeat sub steps
        F
         to
        J
        :
        • Workday Accounts
        • Workday Query Language
        • Worker Data: Current Staffing Information
      12. Search for
        Activate Pending Security Policy Changes
        . Enter your comments and confirm.
    4. Create a REST Client
      1. In the Register Client API page, enter the client name.
      2. For
        Client Grant Type
        , select
        Authorization Code Grant
        .
      3. For
        Access Token Type
        , select
        Bearer
        .
      4. Enter a Redirection URL. Following are the app names for specific regions:
        • USA: http://app.aperture.paloaltonetworks.com/gamma/auth/workday/callback
        • EU: http://app.aperture-eu.paloaltonetworks.com/gamma/auth/workday/callback
        • Singapore: http://app.aperture-apac.paloaltonetworks.com/gamma/auth/workday/callback
        • India: https://app.in1.prisma-saas.paloaltonetworks.com/gamma/auth/workday/callback
        • UK: https://app.uk2.prisma-saas.paloaltonetworks.com/gamma/auth/workday/callback
        • Australia: https://app.au1.prisma-saas.paloaltonetworks.com/gamma/auth/workday/callback
        • Japan: https://app.jp1.prisma-saas.paloaltonetworks.com/gamma/auth/workday/callback
      5. Enable
        Non Expiring Refresh Tokens
        .
      6. For
        Scope (Functional Areas)
        , choose
        System
         and
        Staffing
        .
      7. Click
        OK
        .
      8. Keep the details handy as these will be needed while registering the Workday App in the
        Strata Cloud Manager
        .
      9. Log out as
        Admin User
         as you will be logging in as
        System User
         created in STEP 2 to grant
        Strata Cloud Manager
         permissions in the next section.
    5. Next step
      : Proceed to Add Workday App.

    Add Workday App

    For
    Data Security
     to scan assets, you must consent to specific permissions during adding the Workday app.
    1. Add your Workday app domain as an internal domain.
    2. Go to
      Data Security
      Applications
      Add Application
      Workday
      .
    3. Enter the REST client details that were saved after registering an API client in the previous section and click
      Connect
      .
    4. You will be redirected to Workday. Sign in as the user you created in the above steps and click
      Allow
      . A new Workday instance is now listed under
      Data Security
      Applications
      .
    5. Next step
      : Proceed to Start Scanning and Monitor Results and begin scanning your assets.

    Troubleshooting Onboarding Workday App

    The most common issues related to onboarding a Workday app are as follows:
    Symptom
    Explanation
    Solution
    During onboarding, when you are redirected to Workday and click
    Authorise
    , you are redirected again to Workday (instead of redirecting to
    Strata Cloud Manager
    ) with an error message in the URL.
    This happens when the redirect URL (while registering the API client) is not correct.
    Edit the REST client and ensure the redirect URL is correct.
    During onboarding, when you are redirected to Workday and click
    Authorise
    , a
    500 Internal Server Error
     is displayed instead of redirecting you to
    Strata Cloud Manager
    .
    This issue is intermittent. So, verify if the app is visible on the SaaS portal. If not, check if the client ID and secret match correctly.
    Onboard again with correct credentials.

    Customize Workday App

    If you plan to manage more than one instance of the Workday app, consider differentiating your instances.
    1. (
      Optional
      ) Give a descriptive name to this app instance.
      1. Select the Workday n link on the Cloud Apps list.
      2. Enter a descriptive
        Name
        .
      3. Click
        Done
         to save your changes.
    2. Next step
      : Proceed to Start Scanning and Monitor Results.

    Start Scanning and Monitor Results

    When you add a new cloud app and enable scanning,
    Data Security
     automatically scans for user activity.
    1. Start scanning the new Workday app for risks.
    2. During the discovery phase,
      Data Security
       scans user activity and matches them against enabled default policy rules for user activity.
      Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to the next step.
    3. (
      Optional
      ) Modify match criteria for existing policy rules.
    4. (
      Optional
      ) Add new policy rules.
      Consider the business use of your app, then identify risks unique to your enterprise. As necessary, add new user activity rules.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.