Security PartnerHCM

Deanna BernsteinSecurity Partner Training06/04/2019

Purpose:To assist the Security Partner in understanding their role. Defining the Security Partner, defining Security Group types in Workday, dos and don'ts for the Security Partner, and different scenarios / business processes to Assign Roles in Workday. NOTE: You can only perform these duties while logged into Trinity Network. You cannot outside of the firewall.

Guidelines for use:This should be used by the Security Partner at each RHM in as a reference on how to assign roles and understanding the tasks that come to them from Business Processes.

Security Partner Defined:Perform security management functions for assigned supervisory organizations within specific ministries e.g., assigning roles for colleagues they support as part of business processes as well as completing tasks in specific business processes: terminations, change job, leave requests.

Role Maintainer Defined:The role maintainer is determined by the assigned by security groups in the maintain assignable roles task. This is better explained in some examples.

When you have a person with a Payroll Partner roll (or any role that is defined as being managed by the Central Security Team below) and they get promoted in the same department. In this job change you as a security partner will get a task to assign roles to make sure that they should be keeping their existing roles. If they should then you would either add in the new position number in the Assigned To column, or if they are keeping their same position number you would just submit the task. Because you as the Security Partner cannot assign the Payroll Partner role they hold, this task that you are submitting would then route to the Role Maintainer – Security Administration in this example – to approve the request.

Another example is when you have a person that is a manager at another Ministry but you support them as the Security Partner. Any changes to their position that you get the Assign Roles tasks for where they are a manager of a Supervisory Org at another Ministry would get routed to that Ministry's Security Partner to approve.

Security Group Types in Workday:Role Based (Managed by Ministry’s Security Partner)

• HR Partner• Compensation Partner• Benefits Partner• License and Certification Partner• Recruiter• Etc.

2

User-Based (Managed by Central Security Team)• View Org for Reporting• HR Admin• Compensation Admin• Security Partner• Etc.

Security Partner Dos and Don'ts:What Security Partner can do?

• Assign HR-related/Manager security roles• Remove HR-related/Manager security roles • Manage/approve delegation

What Security Partner cannot do?• User-based role assignments• Integration user-based role assignments• Lock/Unlock Workday accounts• Resetting passwords

NOTE: Labor partner, security partner and all payroll related security roles need to be assigned by central security team.

3

Different Scenarios/Business Processes to Assign Roles in Workday:Non-Business Process Related Role Assignments: Manager role assignment or any ad hoc role assignments for new hires: Add/Remove Roles

There are two ways this can be achieved. From the Supervisory Organization or from the Person that you want to directly assign roles to. **Note this is the process that can be used to assign a person from another ministry that needs access to yours, usually due to supporting a region.

From the Supervisory Organization:1. Navigate to the supervisory organization where roles are to be assigned2. From related, Actions go to Roles3. Click on Assign Roles

4. Select Effective Date

NOTE: Important Note on Effective Date of Role Assignments: BPs routing are effective dated. The steps will route to the positions/workers who were assigned to the security group as of the effective date

4

5. If the role is not available insert a new row (+ sign)

6. If the role is available, click on the Assigned To section and enter the position number of the person you would like to assign

7. Click OK.8. If the supervisory organization already exists, and the manager needs to be changed,

follow the same process of assigning other roles.1. Go to Related Actions of The Organization > Roles > Assign Roles2. Select Effective Date3. In the Assign To area, Assign the Manager role to the appropriate manager4. If you need to change Manager, remove the previous Assigned To Position

and add a new Position

5

From the Person:1. Navigate to the individual Actions > Security Profile > Assign Roles – Add/Remove

6

2. Select Effective Date

3. From this screen you can do a few other things. a. Copy Role Assignments from: You can use this if you have a position that you

already know has all the exact roles that this person needs. This also can be used if you know that a person is leaving a position or is terminating and a new person needs those roles (this is good for recruiters that have a high number of reqs assigned to them)

7

b. The top section shows you what roles both positions have in common. You can check the remove if there are some that are not needed on the position that you copying to.

c. The bottom section shows you what will be copied from the other position. You can also uncheck the box in the Copy column if you wish not to have some copied over.

d. Once you have completed these sections click Submit. e. If you have added roles that need approval they will go off to either another

RHM or a Security admin to approve. 4. You can also Remove All Roles for Assignee if they are moving to another role but

taking the position with them and will not need roles. a. Just check the box and click ok

8

b. You can then pick which roles to remove or if all need to be just submit your changes.

c. If this person had Role Enabled For a supervisory organization that you were not the Security Partner for it would then be routed to the Role Maintainer for approval. Whether that be a Security Admin or a Security Partner at another Ministry.

9

Business Process Related Role Assignments - Inbox Items for the Security Partner:

There are a number of Business processes that have an Assign Roles task that goes to the Security Partner for review. Change Job, Termination, End Contract, and Leave Requests. In each of these you must review the task and roles and determine what needs to happen.

In your inbox you can see where an Assign Roles task was initiated from by clicking on the gear and View Details

This may help in determining what needs to happen.

10

Assign Roles for End Contract, Job Change, Termination, Request Leave, and Return from Leave Request:

1. With all of these, you must then identify who will be replacing this person. a. Is it another position? Then you would x out the current position and add the

new one in.b. Will this position be filled and that person just step into this role? Then you

would just leave it to inherit up to the Default Worker(s) until the position is filled.

c. Specifically for Leave Business Processes does anything need to happen? That person may just need a delegation set up and all roles remain as is. If not you would possibly do a or b above.

d. For a person that is a recruiter – when they are a primary recruiter on hundreds of requisitions the suggested method would be to follow the Copy Role Assignments from their existing position to the person that is getting would now be the Primary. If these are getting split up then you could go through line by line and enter that new position in the Assigned To column. That way no tasks on those requisitions would go to unassigned.

e. After you make the decision, you would submit this task.

11

Role Maintainer Tasks:2. To determine if a task came to you as a role maintainer you will need to view the

details of the task and then go to the overall process to see that is why you got it:

a. Click on the Overall Process link to go to the actual Business Process that generated the task.

12

b. Then click on Process and scroll to the task that you have (Role Assignment Event). You can see that the task above the Role Assignment Event was initiated by the Security Partner. Now that assign roles task needed approval by the Role Maintainer because this person had a role that the submitting security partner was not the security partner.

13

c. You will review the assignment, in this case the person was a manager for a supervisory organization that you are the security partner for, and decide are they remaining in that role with the Change Job or does someone else need to be assigned. Once you have made that decision you will submit the task.

14