Future Hire date employees Provisioning from Workday to Active Directory

Question

Future Hire date employees Provisioning from Workday to Active Directory

Aditya Janagam 6

Hi All

We have implemented AD Provisioning agent to sync the data between Workday & AD in our project which includes new hires, change in attributes, terminations.

Reference: https://v4.hkg1.meaqua.org/en-us/azure/active-directory/saas-apps/workday-inbound-tutorial

However, we do not want future hire employees records to be flown to AD. Even if it does, do not enable the user account until hire date is reached. Please suggest if you implemented the similar solution.

Thanks in advance!

JamesTran-MSFT 37,226 Reputation points Microsoft Employee Moderator

2022-08-15T17:24:10.94+00:00

@Aditya Janagam
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Anonymous

2023-08-10T20:51:37.61+00:00

@JamesTran-MSFT We are running into a similar if not he same issue, we are implementing the Workday to Active Directory Provisioing App, all fields map properly on update function BUT on creation the provisioning is being stopped do to Account disabled in Source (Workday). We have tried expression with datediff BUT cannot get past the provisioning stop.
Anonymous

2023-08-18T18:43:37.5233333+00:00

Any assistance from anyone else having this issue?
Tandon, Devmalika 0 Reputation points

2025-05-21T13:27:48.32+00:00
we want to create active directory account for future dates in Workday, one week in advance. Since workers status is set active only on hire date effective date, Microsoft Intra is unable to create active directory account untill Hire date. Its failing due to skipping and The object is not active in the source system, the object is not assigned to application its telling to review scope filters.

Inactive in the source system → (IsActive = False)

Not assigned to the application → The worker does not have the application assigned to them. → (Assigned to the application = False)

Does not have required entitlement (NotEffectivelyEntitled) → They are missing necessary access or group memberships that would qualify them for provisioning. → (SkipReason = NotEffectivelyEntitled)

Failed scoping filter (IsInProvisioningScope = False) → The worker did not pass all the filters that decide which workers should be included. → (IsInProvisioningScope = False)

Please guide.
Michael Leach 15 Reputation points

2025-05-21T14:33:36.41+00:00

If the record is not Active in Workday, it will not provision and will be out of scope. They need to mark it as Active with a future hire date. Then, it will provision as disabled using the expression above.
Michael Leach 15 Reputation points

2025-05-21T14:34:53.0433333+00:00

If the record is not Active in Workday, it will not provision and will be out of scope. They need to mark it as Active with a future hire date. Then, it will provision as disabled using the expression above. Once the hire date arrives to be within the threshold, it will enable the account.
Dan Bergondy 10 Reputation points

2025-05-21T23:23:17.3033333+00:00
Future dated hires:

I am able to pull the future dated hire data from Workday ... only in Workday Studio!

I set the <as_of_effective_date>=11/30/2025 to date past the hire_date (=11/1/2025)

this pulls the hire_date=11/1/2025 and Active=1

See screenshot below

I set the <as_of_effective_date>=10/30/2025 to date past the hire_date (=11/1/2025)

this pulls the hire_date=NULL and Active=0

When running MS Provisioning from Workday to MS AD

this pulls the hire_date=NULL and Active=0 (I assume it is using as_of_effective_date to today 5/21/2025.

Has anyone "configured" the as_of_effective_date in MS Provisioning? to now plus 30 days or 1/1/2999 ... once the "hire_date" is today or greater the Account is provisioned in MS AD... but that is too late for us.

Bottom line: can I update the response_filter - as_of_effective_date in the MS AD Provisioning app?

Thanks for your help!

Dan
Michael Leach 15 Reputation points

2025-05-22T13:18:35.3933333+00:00

Dan, none of that will matter if the record is inactive in Workday. It has to be set to Active with the start date in the future. Then, you provision the account as disabled until your desired date. There's no way to get it through the scoping filter. The main requirement is "Active=1". I'm actively doing a Workday provisioning and don't see a way to do what you are asking in the last line.
Tandon, Devmalika 0 Reputation points

2025-05-22T13:54:52.3266667+00:00

@ Dan Bergondy -I am also able to pull future effective dated hires in studio, but not able to make changes on Entra side for adjusting scoping filters. can we make or adjust source object scope. where we will adjust response filter criteria on Entra side, this is my question also.

Many organizations are doing this successfully. - provisioning active directory accounts in advance

Thank you for discussing.
Tandon, Devmalika 0 Reputation points

2025-05-22T14:09:41.37+00:00

@Michael Leach How we will achieve this - It has to be set to Active with the start date in the future. Then, you provision the account as disabled until your desired date
Michael Leach 15 Reputation points

2025-05-22T14:42:39.0333333+00:00

@Tandon, Divyanshu HR must set the record to Active in Workday. Nothing will provision in Entra without that. The below expression will allow the account to be provisioned. But, it will be provisioned as disabled if the Start Date is more than 3 days in the future. Once you get within 3 days of the Start Date, the service will enable the account. At this time, all other processes can key off of the account being enabled. Entra Dynamic Groups, app access groups, etc.

Switch([Active], , "1", IIF(DateDiff("d", Now(), CDate([StatusHireDate]))<"3", "False", "True"), "0", "True")
Tandon, Devmalika 0 Reputation points

2025-05-22T15:47:07.5933333+00:00

@Michael Leach Thank you for your response. I’m curious—how is HR able to set a worker to “Active” in the system before their effective hire date in Workday? Have there been any discussions or scenarios you've come across related to this?
Dan Bergondy 10 Reputation points

2025-05-22T16:06:43.9966667+00:00

Hey Guys, when you send the Get_Workers Request... if you set the as_of_effective_date value to a day > the hire date the Response sets the Active=1... before the hire date Active=0. Please see me Workday Studio 2025 screenshot above. So I could update the Request-Response_filter-as_of_effective_date in the MS Provisioning app user would be provisioned... but how can I update the MS Provisioning app... this happens BEFORE the scoping filters applied. Example in screen shot future hire date = 11/1/2025 and as_of_effective_date =11/30/2025... pulls ACTIVE = 1. The as_of_effective_date is pulls the value "as of" THAT date. Not now or today.
Michael Leach 15 Reputation points

2025-05-22T17:29:41.2933333+00:00

@Dan Bergondy I've been doing Workday provisioning in Entra for a few years. But, I've never come across a client using that date that way. I guess they technically can use fields however they want. I always make it understood that nothing can happen until the record is marked as Active=1. Then, we enable the AD/Entra account when they get near the Start Date.
Tandon, Devmalika 0 Reputation points

2025-05-22T17:32:43.0233333+00:00
The person is hired on November 1, 2025.

But if he asks Workday for their status as of November 30, 2025, Workday says "Yep, they're Active." my request is diffrent then yours I am pulling all records as of effective date (future date) active = 1.
Michael Leach 15 Reputation points

2025-05-22T17:33:36.4466667+00:00

@Tandon, Devmalika All of my clients over the years have provisioned in advance of the Start/Hire Date (depending on how they use those). But, as I mentioned to Dan above, I've never come across the use of the Effective Date the way you two are mentioning. I always make it clear that the record needs to be Active=1 for any provisioning to happen. So, when HR enters the record, they keep it as Active=0 through the hiring process until they sign the paperwork and have a start date. Then, they switch the record and the account gets provisioned as disabled ahead of the Start Date. When we get within 3 days of the Start Date, the account gets enabled by the service as I mentioned before.
Tandon, Devmalika 0 Reputation points

2025-05-22T21:57:01.1833333+00:00

My organization is not using Start Date field.
Michael Leach 15 Reputation points

2025-05-23T14:11:10.38+00:00

@Tandon, Devmalika You may want to ask them to start using it. It's the standard attribute for recording their first day of work. Effective Dates are for when record changes are supposed to take effect. Not work start dates. There's a difference between a new hire (someone who has a first day of work determined and an effective date in the past) and a future hire (a candidate who does not yet have a start date and an effective date in the future). This way, you would be able to automate the provisioning and enabling of the accounts.
Tandon, Devmalika 0 Reputation points

2025-05-23T14:40:10.6333333+00:00

@michael leach https://v4.hkg1.meaqua.org/en-us/entra/identity/app-provisioning/workday-integration-reference#query-for-future-dated-hires, pls provide your insights on this also. Thank you in advance
Michael Leach 15 Reputation points

2025-05-23T15:48:00.3166667+00:00

@Tandon, Devmalika Take a look at the Note. It explains what I said above. Obviously, this all depends on how your HR uses the fields in Workday. As it notes, the Active field switches to 1 when the Effective Date equals the Hire Date. This allows the flow through the Provisioning Service and scoping filter and will provision the user on that day. This is why the Start Date is important to provision users ahead of their first day of work but not have the account active. The service will not provision a user who has the Active field set to 0 (prior to the Effective Date landing on the Hire Date).

1 answer

Your answer

JamesTran-MSFT 37,226 Reputation points Microsoft Employee Moderator

2022-08-15T17:24:10.94+00:00

@Aditya Janagam
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Anonymous

2023-08-10T20:51:37.61+00:00

@JamesTran-MSFT We are running into a similar if not he same issue, we are implementing the Workday to Active Directory Provisioing App, all fields map properly on update function BUT on creation the provisioning is being stopped do to Account disabled in Source (Workday). We have tried expression with datediff BUT cannot get past the provisioning stop.
Anonymous

2023-08-18T18:43:37.5233333+00:00

Any assistance from anyone else having this issue?
Tandon, Devmalika 0 Reputation points

2025-05-21T13:27:48.32+00:00

we want to create active directory account for future dates in Workday, one week in advance. Since workers status is set active only on hire date effective date, Microsoft Intra is unable to create active directory account untill Hire date. Its failing due to skipping and The object is not active in the source system, the object is not assigned to application its telling to review scope filters.

Inactive in the source system → (IsActive = False)

Not assigned to the application → The worker does not have the application assigned to them. → (Assigned to the application = False)

Does not have required entitlement (NotEffectivelyEntitled) → They are missing necessary access or group memberships that would qualify them for provisioning. → (SkipReason = NotEffectivelyEntitled)

Failed scoping filter (IsInProvisioningScope = False) → The worker did not pass all the filters that decide which workers should be included. → (IsInProvisioningScope = False)

Please guide.
Michael Leach 15 Reputation points

2025-05-21T14:33:36.41+00:00

If the record is not Active in Workday, it will not provision and will be out of scope. They need to mark it as Active with a future hire date. Then, it will provision as disabled using the expression above.
Michael Leach 15 Reputation points

2025-05-21T14:34:53.0433333+00:00

If the record is not Active in Workday, it will not provision and will be out of scope. They need to mark it as Active with a future hire date. Then, it will provision as disabled using the expression above. Once the hire date arrives to be within the threshold, it will enable the account.
Dan Bergondy 10 Reputation points

2025-05-21T23:23:17.3033333+00:00

Future dated hires:

I am able to pull the future dated hire data from Workday ... only in Workday Studio!

I set the <as_of_effective_date>=11/30/2025 to date past the hire_date (=11/1/2025)

this pulls the hire_date=11/1/2025 and Active=1

See screenshot below

I set the <as_of_effective_date>=10/30/2025 to date past the hire_date (=11/1/2025)

this pulls the hire_date=NULL and Active=0

When running MS Provisioning from Workday to MS AD

this pulls the hire_date=NULL and Active=0 (I assume it is using as_of_effective_date to today 5/21/2025.

Has anyone "configured" the as_of_effective_date in MS Provisioning? to now plus 30 days or 1/1/2999 ... once the "hire_date" is today or greater the Account is provisioned in MS AD... but that is too late for us.

Bottom line: can I update the response_filter - as_of_effective_date in the MS AD Provisioning app?

Thanks for your help!

Dan
Michael Leach 15 Reputation points

2025-05-22T13:18:35.3933333+00:00

Dan, none of that will matter if the record is inactive in Workday. It has to be set to Active with the start date in the future. Then, you provision the account as disabled until your desired date. There's no way to get it through the scoping filter. The main requirement is "Active=1". I'm actively doing a Workday provisioning and don't see a way to do what you are asking in the last line.
Tandon, Devmalika 0 Reputation points

2025-05-22T13:54:52.3266667+00:00

@ Dan Bergondy -I am also able to pull future effective dated hires in studio, but not able to make changes on Entra side for adjusting scoping filters. can we make or adjust source object scope. where we will adjust response filter criteria on Entra side, this is my question also.

Many organizations are doing this successfully. - provisioning active directory accounts in advance

Thank you for discussing.
Tandon, Devmalika 0 Reputation points

2025-05-22T14:09:41.37+00:00

@Michael Leach How we will achieve this - It has to be set to Active with the start date in the future. Then, you provision the account as disabled until your desired date
Michael Leach 15 Reputation points

2025-05-22T14:42:39.0333333+00:00

@Tandon, Divyanshu HR must set the record to Active in Workday. Nothing will provision in Entra without that. The below expression will allow the account to be provisioned. But, it will be provisioned as disabled if the Start Date is more than 3 days in the future. Once you get within 3 days of the Start Date, the service will enable the account. At this time, all other processes can key off of the account being enabled. Entra Dynamic Groups, app access groups, etc.

Switch([Active], , "1", IIF(DateDiff("d", Now(), CDate([StatusHireDate]))<"3", "False", "True"), "0", "True")
Tandon, Devmalika 0 Reputation points

2025-05-22T15:47:07.5933333+00:00

@Michael Leach Thank you for your response. I’m curious—how is HR able to set a worker to “Active” in the system before their effective hire date in Workday? Have there been any discussions or scenarios you've come across related to this?
Dan Bergondy 10 Reputation points

2025-05-22T16:06:43.9966667+00:00

Hey Guys, when you send the Get_Workers Request... if you set the as_of_effective_date value to a day > the hire date the Response sets the Active=1... before the hire date Active=0. Please see me Workday Studio 2025 screenshot above. So I could update the Request-Response_filter-as_of_effective_date in the MS Provisioning app user would be provisioned... but how can I update the MS Provisioning app... this happens BEFORE the scoping filters applied. Example in screen shot future hire date = 11/1/2025 and as_of_effective_date =11/30/2025... pulls ACTIVE = 1. The as_of_effective_date is pulls the value "as of" THAT date. Not now or today.
Michael Leach 15 Reputation points

2025-05-22T17:29:41.2933333+00:00

@Dan Bergondy I've been doing Workday provisioning in Entra for a few years. But, I've never come across a client using that date that way. I guess they technically can use fields however they want. I always make it understood that nothing can happen until the record is marked as Active=1. Then, we enable the AD/Entra account when they get near the Start Date.
Tandon, Devmalika 0 Reputation points

2025-05-22T17:32:43.0233333+00:00

The person is hired on November 1, 2025.

But if he asks Workday for their status as of November 30, 2025, Workday says "Yep, they're Active." my request is diffrent then yours I am pulling all records as of effective date (future date) active = 1.
Michael Leach 15 Reputation points

2025-05-22T17:33:36.4466667+00:00

@Tandon, Devmalika All of my clients over the years have provisioned in advance of the Start/Hire Date (depending on how they use those). But, as I mentioned to Dan above, I've never come across the use of the Effective Date the way you two are mentioning. I always make it clear that the record needs to be Active=1 for any provisioning to happen. So, when HR enters the record, they keep it as Active=0 through the hiring process until they sign the paperwork and have a start date. Then, they switch the record and the account gets provisioned as disabled ahead of the Start Date. When we get within 3 days of the Start Date, the account gets enabled by the service as I mentioned before.
Tandon, Devmalika 0 Reputation points

2025-05-22T21:57:01.1833333+00:00

My organization is not using Start Date field.
Michael Leach 15 Reputation points

2025-05-23T14:11:10.38+00:00

@Tandon, Devmalika You may want to ask them to start using it. It's the standard attribute for recording their first day of work. Effective Dates are for when record changes are supposed to take effect. Not work start dates. There's a difference between a new hire (someone who has a first day of work determined and an effective date in the past) and a future hire (a candidate who does not yet have a start date and an effective date in the future). This way, you would be able to automate the provisioning and enabling of the accounts.
Tandon, Devmalika 0 Reputation points

2025-05-23T14:40:10.6333333+00:00

@michael leach https://v4.hkg1.meaqua.org/en-us/entra/identity/app-provisioning/workday-integration-reference#query-for-future-dated-hires, pls provide your insights on this also. Thank you in advance
Michael Leach 15 Reputation points

2025-05-23T15:48:00.3166667+00:00

@Tandon, Devmalika Take a look at the Note. It explains what I said above. Obviously, this all depends on how your HR uses the fields in Workday. As it notes, the Active field switches to 1 when the Effective Date equals the Hire Date. This allows the flow through the Provisioning Service and scoping filter and will provision the user on that day. This is why the Start Date is important to provision users ahead of their first day of work but not have the account active. The service will not provision a user who has the Active field set to 0 (prior to the Effective Date landing on the Hire Date).

Answer 1

Michael Leach 16

You can use this expression on the accountDisabled attribute flow. Change the number to fit your preference. This one says "The difference between now and the hire date is less than 1 day".

Switch([Active], , "1", IIF(DateDiff("d", Now(), CDate([StatusHireDate]))<"1", "False", "True"), "0", "True")

JamesTran-MSFT 37,226 Reputation points Microsoft Employee Moderator

2022-08-12T17:40:41.04+00:00

@Aditya Janagam
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
Anonymous

2023-09-12T10:47:26.0033333+00:00

I tried the following expression towards BambooHR - I would assume I can use the same expression with some minor adjustments of the expected values from BambooHR through the new Inbound API-driven provisioning connector:

I tried following expression that are mapped to accountDisabled:

Switch([active], , "Active", IIF(DateDiff("d", Now(), CDate([urn:ietf:params:scim:schemas:extension:csv:1.0:User:HireStatus]))<"1", "False", "True"), "Inactive", "True")

The expected result is that the AD account should be in disabled mode, and not enabled from the start before the HireDate.

Share via

Future Hire date employees Provisioning from Workday to Active Directory

1 answer

Your answer