Frequently Asked Questions about HR Security in Workday

Role-based access requesters and approvers can see their own and others' security assignments in Workday by:

1. Navigating to the worker in Workday and selecting the correct position
2. Selecting Actions and hovering over Security Profile
3. Selecting View Role Assignments for Worker Position and running the report

Employees who are not requesters or approvers cannot see a list of the roles that are assigned to them within Workday. However, other employees may be able to view Workday role mappings through the Universities of Wisconsin Tableau site. You must be logged into WiscVPN (Global Protect) in order to access Tableau and the workbook.

Role-based security in Workday is assigned to the position, not the person. If the employee's former position remains active and available to fill, the person who is later hired into that position will automatically get the same security as the former employee. If you need to adjust the security roles assigned to the position, you can make the adjustments in the Assign Roles business process at any time, including while the position is vacant.

When a vacancy occurs and no one else is assigned to the same role for the organization, the next-level manager or employee will automatically and temporarily inherit the security associated with that position.

Example 1: if Scott reports to Maria and Maria reports to Liz, and Maria retires, Liz will assume the duties of Scott's manager (approving time off, etc.) until Maria's former position is filled.

Example 2: Troy was the Absence Partner (Supervisory) for a department before he transferred to a different job at the university. Nadia is the Absence Partner (Supervisory) for the superior supervisory organization, which is at the divisional level. Until Troy's former position is filled, future tasks associated with that role will route to Nadia.

This indicates what organization the role is assigned at. Local HR roles are assigned to the top of the UW-Madison location hierarchy. These roles have access to all workers, positions, and jobs on campus, and are typically only used by Office of Human Resources (OHR) staff. Supervisory HR roles are assigned to supervisory organizations ("sup orgs") and are usually assigned to School, College, and Division (S/C/D) HR staff.

Many role assignments in Workday are inherited, which means the role assignment might apply to organizations that are lower in the hierarchy than the organization they are directly assigned to. These types of roles should be assigned at the highest appropriate level of the organization, which helps streamline security role assignments and prevent inheritance from breaking. Most roles are only inherited if no one else is assigned the role for a subordinate organization, but some roles might always inherit down regardless of assignments at the lower level. Other roles may not be inherited at all. For more information, see Guide to Role Inheritance and Access Rights in Workday.

Paired roles are security roles that are automatically assigned to someone with another role (called a base role). Most of these roles are not requestable and are only assigned through the automatic role pairing process, but there are a few exceptions (called standalone roles). For more information, see Guide to Security Role Pairing in Workday.

This indicates that the role was created or customized specifically for the Universities of Wisconsin configuration of Workday. It has no bearing on the actions a role can perform and does not have anything to do with breadth of responsibility.

Yes. While it is expected that the Student Hourly and Student Assistant Process Coordinators will perform most of these functions for their respective employees, HR Process Coordinators and HR Partners can both initiate actions on Student Hourlies (SH) and Student Assistants (SA), if needed. Please note that if an HR Process Coordinator initiates a business process for an SH or SA employee, future steps (including approvals) will still be sent to the SH Process Coordinator or SA Process Coordinator.

No. The manager role is automatically assigned within Workday based on the supervisory organization structure, and cannot be requested separately.

The process to remove a role is the same as adding a new one. See Request to Add or Remove a Workday Security Role Assignment for more details.

When you request the assignment of a role that will create a Separation of Duties (SOD) conflict, the system will generate an alert message. SOD conflicts occur when someone has multiple role assignments that allow them to perform duties without sufficient checks and balances, violating best practices. Role assignments should not be requested or approved if they create an SOD conflict. To view which roles have SOD conflicts with other roles, see the Simplified HR Security Role Catalog or the UW Security Catalog: Assignable Roles and User Based Groups report in Workday.

Not necessarily. The approver will also need to have the Role-Based Access Requester UW role in order to initiate requests of their own.

To authorize new role-based access requesters and approvers, someone who already has the Role-Based Access Requester UW needs to initiate a role assignment request for the new requester/approver. The task will also need to go through the same approvals as any other HR role request before it takes effect.

For assistance, please send an email to hris@ohr.wisc.edu.