In Workday, role-based security assignments are assigned to positions, not individual users. However, when an employee with assigned security roles leaves their position, the HR Partner (Supervisory) receives a task to review the security roles assigned to the vacated position. This task ensures that, if needed, security roles can be adjusted before someone else is hired into the position.
This article describes best practices for handling these Assign Roles steps that are generated from Termination, End Additional Job, and Change Job transactions where a position is being vacated. It also provides a guide to completing the Assign Roles task. In most cases, the recommended selection is none of the above, since this retains the security roles assigned to the position(s).
Options for Termination/End Additional Job
When an employee terminates or their additional job ends, and their former position is assigned one or more security roles, the Assign Roles task provides three options:
Transfer role assignments
Consider this option when:
- The vacated position will not be reused, and;
- One or more other positions will take over the vacated position’s role assignments.
When selecting who to transfer role assignments to, be sure to select a position, not a person. It is recommended to search by position number.
Remove all role assignments
Consider this option when the vacated position will be closed or not reused.
None of the above
This is the recommended option in most cases. This retains the security roles on the vacated position. If needed, the roles can be adjusted later using the manually-initiated Assign Roles business process (See: Request to Add or Remove a Workday Security Role Assignment).
When there are multiple assignees with the same role for an organization, the other assignees can still act on the associated tasks while the position is vacant. If the vacated position is the only role assignee, consider temporarily transferring its role assignments until the position is filled. You can do this using the Transfer Role Assignments option, or manually using the Assign Roles business process.
Options for Change Job
When an employee changes position numbers via Change Job (lateral move/transfer, promotion, or demotion), and their former position is assigned one or more security roles, the Assign Roles task provides five options:
Transfer role assignments from old position to new position
Consider this option when:
- The employee is staying in the same department and will be performing the same duties, and should therefore retain the same roles in their new position, and;
- The vacated position will be closed or not reused, or will have different security role assignments.
Copy role assignments from old position to new position
Consider this option when:
- The employee is staying in the same department and will be performing the same duties, and should therefore retain the same roles in their new position, and;
- There is a plan to fill the vacated position, with the future incumbent performing the same responsibilities and having the same role assignments.
Copy role assignments to new position from
Consider this option when:
- The employee’s responsibilities and security roles are changing with their change in position, and;
- The roles for the new position can be copied from a similar position, and;
- There is a plan to fill the vacated position, and the future incumbent will perform the same responsibilities and should therefore retain the same roles.
When selecting who to copy role assignments from, be sure to select a position, not a person. It is recommended to search by position number
Remove role assignments from old position
Consider this option when:
- The old position will be closed and not reused, and;
- The new position does not require any security role assignments, or the security roles on the new position are already configured.
None of the above
This is the recommended option in most cases. This retains the security roles on each position. If needed, the roles on either position can be adjusted later using the manually-initiated Assign Roles business process (See: Request to Add or Remove a Workday Security Role Assignment).
When there are multiple assignees with the same role for an organization, the other assignees can still act on the associated tasks while the old position is vacant. If the vacated position is the only role assignee, consider temporarily assigning the role to one or more other positions using the Assign Roles business process.
Completing the Assign Roles Task
Complete the Assign Roles task
| Step 1 |
From the task in My Tasks, select the appropriate option using the guidance provided above. |
|---|---|
| Step 2 |
If you need to select someone to transfer role assignments to (from Termination/End Additional Job) or to copy role assignments from (from Change Job), enter their position number in the box. You can also search by the incumbent name, but be sure to select the option that contains their position number (E.g., 01012345 HR Generalist - Buckingham Badger). Do not select the option with only the person’s name. |
| Step 3 |
Click OK. |
| Step 4 |
For each security role assignment on the Assign Roles - Change Assignments for Worker page, review the position(s) listed for Assignees to Add and Assignees to Remove. If you are transferring security role assignments and the roles are being split across multiple positions, or multiple positions will take over the same role assignment, adjust the positions listed for each role under Assignees to Add.
|
| Step 5 |
When finished, click Submit. If the request contains any paired roles that shouldn’t be assigned manually (See: Guide to Security Role Pairing in Workday), Workday will prompt you to remove those roles by clicking the minus symbol (-) in the leftmost column and resubmitting. |
| Step 6 |
If any changes were made, the request will proceed through the normal approval process (See: Review and Approve Role-Based Access Requests). |
