Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
hcm & finance

Workday integrations and apps that still work the Monday after a feature release.

Workday tenants pile up integrations the way old ERPs piled up custom code. There are EIBs nobody owns, Studio projects only one person can open, and reports doing integration work. We rebuild the fragile ones in Orchestrate and build what's missing in Extend. Everything gets tested before each release.

Talk to a Workday engineerWhat changed recently
platform dossierWorkdayHCM & finance
Deployment
SaaS, single codeline
Release cadence
Two feature releases a year, March and September; 2026R2 on 19 Sep 2026
Developer program
Open to anyone since Rising, Oct 2026; personal tenants in beta
Integration tools
EIB, Studio, Orchestrate, REST and SOAP APIs
release watch
  • Autopilot agents, Talent Acquisition firstEarly 2027
  • Prism datasets through Data Cloud in 27R127R1
connects with
NS
in short·15-second read

Cohash builds Workday integrations in EIB, Studio and Orchestrate, and we build Extend apps, agents and Prism or Data Cloud pipelines too.

Extend AI agent tools and Data Cloud have been generally available since October 2026. Talent Acquisition autopilot is early adopter only, with GA planned for early 2027. Every integration goes through the preview tenant before each release.

you probably need this if
  • Payroll or benefits feeds broke after the last feature release and nobody tested them in preview.
  • There are EIBs and Studio integrations in production that nobody can explain.
  • One Workday process still lives in a spreadsheet a business team updates by hand, because nobody built an app for it.
terms on this page tenantdefinitionYour company's Microsoft account. Every environment draws on one shared pool of storage, so a bloated test copy hits everyone.explained in a field note →
Ask an engineer facts checked 2026-10-29
how it runs
  1. 01Integration and tenant review
  2. 02Rebuild plan
  3. 03Build and preview test
  4. 04Run and hand over
you keep
  • An integration register that shows who owns each flow, when it runs, its ISU and how often it fails
  • Orchestrate rebuild plan, worst-hurting integrations first
  • A regression pack to run in the preview tenant before every feature release
+ 3 more documents
who does it
Workday integration developer (Orchestrate, Studio, EIB)Workday Extend developerWorkday Prism Analytics specialist Workday Pro Workday Orchestrate Developer Certification Workday Pro Workday Extend Developer I Certification
platforms
NS
proof
7 case studies on this
background
Time to get under Copy, restoreblocked Sandboxadmin-only Sandboxdisabled Day 0 Day 90
field note · 15 minDynamics 365 storage limits start to bite on 9 November: what gets blocked, how to get out
workday · release timeline
  1. 19 Sep 2026 2026R2 feature release 2026R2, the second feature release of the year, went to production on 19 September 2026. Anything that broke that weekend belongs in the preview regression pack before the next release comes around.
  2. 13 Oct 2026 Extend AI agent tools and Data Cloud generally available Developer Agent, Custom Agents and Agent-Ready Tools are GA in Extend AI, and so is Data Cloud, with Live Data Query and Agent Lake. Agent pilots that were waiting on GA can go ahead, and they still need testing against real security groups.
  3. today · Nov 09, 2026
  4. Early 2027ahead Autopilot agents, Talent Acquisition first Only the Talent Acquisition Agent has autopilot today, and only for early adopter customers. Workday plans general availability for early 2027, when Payroll, Accounting and Deployment Agents are also meant to reach early adopters. Settle which actions can run without a person, and how often agents run, before you switch it on. Run frequency is also one way to control cost.
  5. no date yetPrism datasets through Data Cloud in 27R1Workday says Data Cloud won't replace Prism. Outbound zero-copy access to existing Prism datasets, so Snowflake, Databricks or AWS can read them without a copy, is due to reach general availability in 27R1. Until then, work out which datasets should move and which stay in Prism.
  6. no date yetWorkday Developer Program opened to allAt Workday Rising (12 to 15 October 2026), Workday opened its APIs, MCP tools and developer docs to anyone, no login needed. You can join with a personal email and ask for a personal development tenant, which is still in open access beta. Prototype there before you touch a shared sandbox.
the story · workday estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Workday estate, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • Payroll or benefits feeds broke after the last feature release and nobody tested them in preview.
    • There are EIBs and Studio integrations in production that nobody can explain.
    • One Workday process still lives in a spreadsheet a business team updates by hand, because nobody built an app for it.
  2. chapter 02 · what we change

    How we solve it

    • Integration build and rebuild
    • Workday Extend apps
    • Agents on Workday
    • Prism Analytics and Data Cloud
    • Feature release testing
    • Staffing
  3. chapter 03 · how it runs

    Our approach

    • Integration and tenant review
    • Rebuild plan
    • Build and preview test
    • Run and hand over
  4. chapter 04 · where you end up

    What changes

    • Every integration now has an owner and a write-up.
    • Managers now start from a drafted request.
    • An integration register that shows who owns each flow, when it runs, its ISU and how often it fails
    • Orchestrate rebuild plan, worst-hurting integrations first
what we do

Our Workday work

6 kinds of Workday work, each run by engineers who have done it on live tenants.

  1. EIB for simple loads, Orchestrate for new event-driven and API-to-API flows, and Studio for the complex legacy cases. Each one gets an owner, an integration system user and error alerts.

  2. Custom apps, business objects and orchestrations built in Workday Extend, with security domains designed alongside so the app follows the tenant's access model.

  3. Extend AI custom agents and agent-ready tools scoped to specific tasks, with Workday permissions and approvals deciding what each agent can read and change.

  4. Prism datasets that blend Workday and external data for reporting, and zero-copy sharing with Snowflake or Databricks where the data platform should own it.

  5. Regression testing in the preview tenant before each March and September feature release, focused on integrations, business processes and security changes.

  6. Workday integration developers, Extend developers, Prism specialists and HCM or Financials functional consultants on contract, contract-to-hire or permanent terms.

capability 01 / 06in production

Integration build and rebuild

EIB for simple loads, Orchestrate for new event-driven and API-to-API flows, and Studio for the complex legacy cases. Each one gets an owner, an integration system user and error alerts.

talk to an engineer about this →
capability 02 / 06in production

Workday Extend apps

Custom apps, business objects and orchestrations built in Workday Extend, with security domains designed alongside so the app follows the tenant's access model.

talk to an engineer about this →
capability 03 / 06in production

Agents on Workday

Extend AI custom agents and agent-ready tools scoped to specific tasks, with Workday permissions and approvals deciding what each agent can read and change.

talk to an engineer about this →
capability 04 / 06in production

Prism Analytics and Data Cloud

Prism datasets that blend Workday and external data for reporting, and zero-copy sharing with Snowflake or Databricks where the data platform should own it.

talk to an engineer about this →
capability 05 / 06in production

Feature release testing

Regression testing in the preview tenant before each March and September feature release, focused on integrations, business processes and security changes.

talk to an engineer about this →
capability 06 / 06in production

Staffing

Workday integration developers, Extend developers, Prism specialists and HCM or Financials functional consultants on contract, contract-to-hire or permanent terms.

talk to an engineer about this →
typical situations

Workday situations we walk into

We pieced these together from Workday situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

Ninety integrations, three of them Studio projects nobody can open

composite · not a client story
  1. Beforethe situation

    A Workday tenant runs about ninety integrations across EIB, Studio and connectors. Three critical Studio projects were built by a former contractor, and the September release broke a benefits feed.

  2. What we dothe work

    We build an integration register straight from the tenant and fix the benefits feed in preview first. Then we reverse-engineer the three Studio projects and rebuild them in Orchestrate, each with error alerts and a named owner. A preview regression pack is in place before the March release.

  3. Afterwhere you end up

    Every integration now has an owner and a write-up. The next feature release gets tested in preview before payroll or benefits ever see it.

case file 02

HR wants job changes drafted automatically, and security has one question

composite · not a client story
  1. Beforethe situation

    HR business partners want an agent that drafts job change requests from manager notes. Security's question is simple: can the agent see compensation for people outside the manager's org?

  2. What we dothe work

    We build the agent in Extend AI on agent-ready tools, so it runs with the requesting user's own Workday permissions. Test cases pull in managers from different supervisory orgs. Nothing in the tenant changes until the draft has been through the standard job change business process.

  3. Afterwhere you end up

    Managers now start from a drafted request. And the agent sees nothing the person asking couldn't already see.

case studies

Workday case studies

All case studies
migration ERP and HCM

PeopleSoft HCM to Workday migration

Moving PeopleSoft HCM to Workday with effective-dated history, payroll, integrations and the identity feed rebuilt and tested.

read the case study
migration Identity and access

AD FS federation to Entra ID authentication

Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.

read the case study
consolidation Identity and access

Identity integration after a merger or carve-out

We give people access on day one after a merger or divestiture. Then directories, identity providers and governance get merged or separated, on a plan.

read the case study
migration Identity and access

IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt

Getting off IBM ISIM, Oracle OIM or homegrown provisioning scripts and onto SailPoint or Saviynt, with provisioning, certifications and audit history intact.

read the case study
consolidation Identity and access

Consolidating Okta and Entra ID after years of running both

Picking one primary identity provider after years of running Okta and Microsoft Entra ID side by side, then moving apps, MFA and provisioning to it.

read the case study
upgrade Identity and access

IdentityIQ 8.x to 9.0 upgrade

Upgrading SailPoint IdentityIQ 8.x to 9.0, with the route through 8.5, the iiq-precheck scan, javax to jakarta fixes and a tested rollback.

read the case study
approach

How a Workday engagement runs

We don't start a step until the last one has produced something you can check.

  1. step 01

    Integration and tenant review

    We list every integration system and every EIB, Studio and Orchestrate flow in one place, with its owner, schedule and failure history. Then we go through the integration security groups and the Extend apps already in the tenant.

  2. step 02

    Rebuild plan

    Fragile integrations get ranked by business impact. New and rebuilt flows go to Orchestrate where it fits. We only keep Studio where it's genuinely still the right tool.

  3. step 03

    Build and preview test

    Apps, integrations and agents get built in a sandbox or a personal development tenant first. Before each feature release we run them against the preview tenant and fix whatever breaks there.

  4. step 04

    Run and hand over

    Your team gets the alerts, the runbooks and an integration register. We also leave a release-testing checklist for March and September, so someone on your side can run the next preview window.

ai on workday

Where AI fits on Workday, and where it needs guardrails.

Builders know Workday's AI as Workday Extend AI. Developer Agent, Custom Agents and Agent-Ready Tools are generally available. After Rising in October 2026, the APIs, MCP tools and developer docs no longer need a login to read. There's also a new Anthropic partnership connecting Developer Agent to Claude. For us, most of the engineering is keeping agents inside Workday security and its business processes.

AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Workdaydoes the work

Workday publishes MCP tools next to its APIs, and they're readable without a login. Agents run under Workday security groups, permissions and approvals, as an integration system user or in the requesting user's context. We scope each agent separately, test with real security groups, and rely on Workday's audit trail for changes.

Custom Agents and Agent-Ready Tools

Custom Agents work on Workday data through Agent-Ready Tools that follow Workday permissions and approvals. Each agent we build does one task and runs under the requesting user's security. Changes go through the normal business process, which means a drafted job change still needs a person's approval.

Developer Agent

Developer Agent works in Claude Code, Cursor, VS Code and Google Antigravity to help build Extend apps and integrations. We use it in sandboxes and personal development tenants, with code review and tests against the preview tenant before each feature release.

Agent Passport

Agent Passport, in early access, lets IT teams verify agents that work with Workday. We'd pilot it alongside your identity governance tool so each agent has an owner and a review date.

Open developer program

Workday's developer program now takes anyone with a personal email, and personal development tenants are in open access beta. Prototyping agents and training new developers no longer means touching a customer tenant.

architecture

Workday and everything wired to it

Everything starts with the worker record in Workday. Hires and job changes go out through Orchestrate and Studio to identity, payroll and finance systems. Snowflake reads through Data Cloud without taking a copy, and any Extend AI agent still works inside Workday's permission model.

Workday and everything wired to it Everything starts with the worker record in Workday. Hires and job changes go out through Orchestrate and Studio to identity, payroll and finance systems. Snowflake reads through Data Cloud without taking a copy, and any Extend AI agent still works inside Workday's permission model. 01 · WORKDAY TENANT 02 · INTEGRATION 03 · DOWNSTREAM SYSTEMS 04 · DATA AND AI business events worker changes provision payroll inputs bulk load business objects Data Cloud share MCP tools WO Workday HCM andFinancials workers · ledgers ·BPs Workday Extend apps · Extend AI agents Orchestrate and Studio events · APIs · files EIB bulk loads Okta workforce SSO SP SailPoint lifecycle · reviews Payroll and benefits third-party providers Snowflake zero-copy share Claude MCP · DeveloperAgent © Cohash · cohash.com
01 · WORKDAY TENANT02 · INTEGRATION03 · DOWNSTREAM SYSTEMS04 · DATA AND AI Workday HCM and Financials: workers · ledgers · BPs Workday HCM andFinancials workers · ledgers· BPs Workday Extend: apps · Extend AI agents Workday Extend apps · Extend AIagents Orchestrate and Studio: events · APIs · files Orchestrate andStudio events · APIs ·files EIB: bulk loads EIB bulk loads Okta: workforce SSO Okta workforce SSO SailPoint: lifecycle · reviews SailPoint lifecycle ·reviews Payroll and benefits: third-party providers Payroll andbenefits third-partyproviders Snowflake: zero-copy share Snowflake zero-copy share Claude: MCP · Developer Agent Claude MCP · DeveloperAgent business events worker changes payroll inputs bulk load Data Cloud share MCP tools © Cohash · cohash.com
use cases

Typical Workday projects

The work teams usually bring us, and the platforms Workday has to talk to while we do it.

  1. WOR-01 Integrations fail after a feature release and payroll finds out first common request
  2. WOR-02 Dozens of EIBs and Studio projects have no owner or documentation common request
  3. WOR-03 The business needs an app inside Workday instead of a spreadsheet beside it common request
  4. WOR-04 You want agents to work on Workday data, but nobody wants them going around its security model common request
  5. WOR-05 Analysts want Workday finance and HR data in Snowflake or Databricks, and nobody wants another nightly copy common request
  6. WOR-06 Recruiting wants Talent Acquisition autopilot, and nobody has decided what it may do on its own common request
Workday · connected platforms
SnowflakeDatabricksSalesforceAnthropic ClaudeOktaSailPointOracle NetSuiteOracle PeopleSoft
you keep

What a Workday engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

  • inventory01

    An integration register that shows who owns each flow, when it runs, its ISU and how often it fails

    yours to keep
  • plan02

    Orchestrate rebuild plan, worst-hurting integrations first

    yours to keep
  • tests03

    A regression pack to run in the preview tenant before every feature release

    yours to keep
  • design04

    Extend app design, with the security domains and business objects worked out up front

    yours to keep
  • tests05

    A design for each agent's scope and permissions, tested as users from each relevant security group

    yours to keep
  • document06

    A per-dataset decision on Prism or Data Cloud sharing, written down

    yours to keep
talent and delivery · workday

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
certifications our engineers hold
  • Workday Pro Workday Orchestrate Developer CertificationWorkday
  • Workday Pro Workday Extend Developer I CertificationWorkday
  • Workday Pro Prism Analytics CertificationWorkday
roles we staff
  • Workday integration developer (Orchestrate, Studio, EIB)
  • Workday Extend developer
  • Workday Prism Analytics specialist
  • Workday HCM functional consultant (core HR, security)
  • Workday Financials functional consultant
  • Workday payroll and benefits integration analyst
due diligence · workday

Questions to ask any partner, including us.

Put these to anyone bidding on your Workday work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    Which of our integrations should move to Orchestrate, and which are fine staying in Studio or EIB?

    Rebuilding everything is wasted effort. Leaving fragile Studio projects alone keeps the risk where it is. Decide integration by integration.

  2. Q2

    How exactly will you test our integrations in the preview tenant before each feature release?

    Workday ships two feature releases a year, each with a preview window. Breaks are cheapest to catch there, before payroll finds them.

  3. Q3

    How does each agent inherit Workday security, and can you show us the test results?

    An agent should only do what the person asking is allowed to do. Run it as users from real security groups and you'll find out quickly whether it does.

  4. Q4

    Which datasets stay in Prism, and which go to our data platform through Data Cloud?

    Duplicate pipelines leave you with two versions of headcount and cost. Decide dataset by dataset where each one lives.

  5. Q5

    Will you prototype in a personal development tenant before touching our sandbox?

    Workday now has personal development tenants in beta. Prototyping in one keeps experiments out of shared environments.

01Should a new Workday integration use EIB, Studio or Orchestrate?

EIB for simple inbound or outbound file loads. Orchestrate for most new integrations, especially event-driven flows from business processes and API-to-API calls. Studio is still there for complex legacy cases. We pick per integration based on volume, logic and who will support it.

02What did Workday's open developer program change?

Mostly it lowered the barrier. Since Rising in October 2026 the docs, APIs and MCP tools are readable without a login, and anyone can join with a personal email. Personal development tenants are in open access beta, so new developers can learn and prototype without borrowing a customer tenant.

03Can we use Workday's autopilot agents yet?

Only if you're an early adopter, and only in the Talent Acquisition Agent for now. Workday plans to make it generally available there in early 2027. Payroll, Accounting and Deployment Agents should reach early adopters around then, though Workday hasn't said when they'll be GA. You decide which actions run on their own and how often agents run, and the second one is a cost lever too. Recruiters still approve outreach before a candidate sees anything.

04How do you stop a Workday feature release from breaking our integrations?

Workday ships two feature releases a year, in March and September, with a preview window before each. We run a regression pack on the preview tenant covering every production integration, the business processes they trigger and security changes in the release notes.

05Is Workday Data Cloud replacing Prism Analytics?

No. Workday says Prism stays, and Data Cloud gives it a wider audience. Data Cloud went GA in October 2026, and outbound zero-copy access to existing Prism datasets is due for GA in 27R1. Keep data that needs Workday security in Prism and share what the analytics platform should own. We decide dataset by dataset.

06Can we connect AI to Workday and keep our security groups in charge?

Yes, if each one is scoped. Extend AI agents and agent-ready tools run under Workday's own permissions and approvals, with an audit trail. We give each agent a narrow scope and try it as users from real security groups before it goes near production.

07Do you also cover PeopleSoft to Workday moves?

Yes. We map PeopleSoft data and customizations to Workday, build the conversion loads and integrations, and run parallel payroll before cut-over.

services

Related services

Projects on Workday usually end up touching one of these, so they're worth a look.

you are hereWorkday
fact-checked Checked against vendor and official documentation last checked 2026-10-29 content fingerprint 03613561
  1. 01Book a 30-minute working sessionsenior engineer
  2. 02Talk to an engineer about your setupreply within 24 hours
  3. 03See how similar projects wentcase studies
Reviewed by the Cohash team Workday is a trademark of its owner, used here to identify the platform. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it