Security
Related Learning Hubs:
Security
Security Roles determine the information you can view and the actions you can take (e.g., initiate, review, approve) within Workday. Security roles are generally assigned to positions allowing employees to complete the work required of them within their department or unit. Security roles are used to determine what Workday training employees are expected to complete.
Important Considerations
- Security roles are not job titles.
- Security roles are assigned to the position, not the person. Should an employee change positions, all viewer access or available actions and approvals would stay with the position. New employees hired into the position will automatically be granted the security roles associated with that position.
- Security roles allow employees to functionally support the organization(s) to which they are assigned. Security roles allow employees to support their Academic Unit, Company, Cost Center, Gift, Grant, Project, Supervisory Organization, USource, etc.
- View-Only role access grants users permission to view items without permitting access to complete actions or modify the data.
Terminology
- Employee as Self – All workers have the Employee as Self role in Workday. See the Employee Self-Service Learning Hub for more information about the self-service tasks a worker can complete.
- Manager – The manager of a supervisory organization is automatically assigned the Manager role in Workday. Typically, these individuals supervise one or more direct reports. One manager can manage multiple supervisory organizations.
- Campus Unit – Campus Unit refers to a type of security role which is assigned to support the activities of specific campus units such as a department, division, or college. For example, an individual in UMD’s College of Behavioral and Social Sciences (BSOS) could be assigned as an HR Analyst to support the HR activities of that particular college.
- Central Office – Central Office (or Central) refers to a type of security role which is assigned to support the overall activities of the institution whose actions can impact multiple campus units. For example, the Central Absence Partner is a central office role assigned to support multiple campus units across the university.
Reports
- Role Assignments for Worker Position (from the worker profile, not searchable) – This report allows an employee to access a list of the roles to which their position has been assigned and the associated organization each role is assigned to support. Employees can access this report by visiting their worker profile, selecting Actions, navigating to the Security Profile submenu, and then clicking the name of the report. Managers can also access this report for the team members to which they support. Similarly, they must navigate to the employee's worker profile to access this report.
- View Support Roles (from the worker profile, not searchable) – This report allows employees to access a list of individuals assigned to each role supporting the organizations to which they belong. Employees can access this report by visiting their worker profile, selecting the Job section from the menu to the left, and then selecting the Support Roles tab at the top. Managers can also access this report for the team members they support. Similarly, they must navigate to the employee's worker profile to access this report.
Can I have more than one security role?
Yes. Roles are based on groups of tasks someone can do or view, and are not tailored to each person’s specific job. Most people will only have tasks they can do as an Employee as Self role. Some people will have multiple roles if they are responsible for several tasks for a small department.
How were security roles assigned?
Assigning accurate security roles for over 28,000 individuals is no easy task, so the Elevate Program has utilized existing systems like KFS and PHR to help assign roles. In addition, PIT Crews (teams that represent units across UMD and the partner institutions) and business owners have helped map other key roles in campus units and Central Office, respectively.
Will I automatically get the same permissions I have in KFS and PHR today?
The way security is handled in current systems is different from the way Workday security is designed. The Elevate Program has used KFS and PHR security permissions as a starting point for building access for positions in Workday for some roles. PIT Crews have also helped guide role assignments in the divisions and colleges.
What if our unit has a vacancy? If security is on a position, how will that work get done?
If the role was held by only one position, that security responsibility will inherit to the worker that holds that role at the parent organization. Using an example, if a role at the department is vacant, the divisional role holder will fill the role temporarily until the position is refilled. You can also request an additional assignment if inheritance is not the best option for the vacancy.
Can security roles be changed before Go Live?
Employees are constantly being hired, changing positions, and leaving during the course of any system implementation. We expect there will be instances where roles need to be changed or updated over the next few months all the way up to Go Live and even beyond.
To request a new role or role modification for you or a member of your department/unit, you should contact your PIT Crew Lead with the specifics of your request. Requests should be limited to changes to assignable roles and not general updates to a team roster. For example, hiring a new team member who will only need the Employee as Self role would not necessitate the need for a request. However, hiring a new HR Analyst would facilitate the need for a request to be made.
Can security roles be changed after Go Live?
The Elevate Security team is continuing to define the process for requesting a new role or role modification after Workday goes live. The Elevate Security team is identifying 1) who can request a role or role modification 2) which system we'll use for intaking these requests and 3) the approval routing for each role. We'll have finalized information for you prior to Go Live.
List of Security Roles
The following list includes each of the campus unit security roles which have been assigned in Workday and their description. Please note, other central office security roles have been assigned in Workday which are not included in this list.
Navigate by Security Role:
| Workday Security Roles | Description |
|---|---|
| Absence Partner | The Absence Partner is a campus unit role that will work with the Central Absence Partner to administer the leave of absence process for worker's within their campus unit. They will confirm an employee's work schedule during the leave of absence process and can request time off, a leave of absence, or a return from a leave of absence on behalf of an employee. |
| Academic Absence Partner | The Academic Absence Partner is a campus unit role that will work with the Central Absence Partner to administer the leave of absence process for faculty members within their campus unit. They will confirm the faculty member's work schedule during the leave of absence process and can request time off, a leave of absence, or a return from a leave of absence on behalf of a faculty member. The Academic Absence Partner will also be tasked with entering Sabbatical Leave and Approved Leave of Absence Without Pay requests approved via the Office of Faculty Affairs until such time that these requests are initiated in Workday. |
| Academic Analyst | The Academic Analyst is a campus unit role responsible for initiating the academic appointment processes including add/update/end. The role can be at the unit level, department level, or college level. |
| Academic Chair | The Academic Chair is a campus unit role with view only access to academic data for the academic department to which they are assigned and the subordinate academic departments in the hierarchy. and below. They do not have access to act on, update, or initiate transactions on this data. The Academic Chair also receives notifications for Graduate Faculty Appointments/Membership Status. |
| Academic College Partner | The Academic College Partner is a UMCP-only campus unit role which approves the academic appointment process (add, update, or end) at the college level. |
| Academic Dean | The Academic Dean is a campus unit role with view only access to the academic data for the academic college to which they assigned and the subordinate academic departments in the hierarchy. They do not have access to act on, update, or initiate transactions on this data. |
| Academic Department Partner | The Academic Department Partner is a UMCP-only campus unit role which approves the academic appointment process (add, update, or end) at the department level. |
| Academic Partner | The Academic Partner is a campus unit role which approves the academic appointment process (add, update, or end). This role is the only approval in the approval process at UMCES & UMES. This role is responsible for Unit level approvals at UMCP. |
| Academic Viewer | The Academic Viewer is a campus unit role with view only access to the academic data for the academic college to which they assigned and the subordinate academic departments in the hierarchy. They do not have access to act on, update, or initiate transactions on this data. |
| Ad Hoc Payment Template Initiator | The Ad Hoc Payment Template Initiator is a role created to give select campus users the ability to create payments from a template for recurring financial activity. Common use cases include but are not limited to individuals paying travel card bills and petty cash custodians. |
| Adaptive Planning User-Based | The Adaptive Planning User-Based is a campus role granting a user access to Adaptive Insights. |
| Asset Specialist | The Asset Specialist is a campus unit role responsible for actions such as initiating request forms to notify the central asset team of any necessary changes to the asset (ex. edit the name, dispose it, change location, etc.). This user will also be responsible for conducting physical inventory for their cost center's assets. |
| Award Contract Analyst | The Award Contract Analyst is a campus unit role responsible for performing award reporting functions for assigned grants across one or more awards. |
| Cost Center Customer Specialist | The Cost Center Customer Specialist is a campus unit role responsible for requesting new Customers, adding Bill-To Contacts, creating Customer Invoices, and creating and amending Customer Contracts. Reporting is limited to the Cost Center to which the individual is assigned. |
| Cost Center Financial Analyst | The Cost Center Financial Analyst is a campus unit role who performs financial reporting functions for assigned USources such as manager financial reporting and metrics, and spend analytics. No initiator or approval rights - Reporting Only role. |
| Cost Center Procurement Reviewer | The Cost Center Procurement Reviewer is a campus unit role which reviews and enhances requisition data before approve or sending the requisition back. They review worktag values and ensure that any departmental processes were followed. They have access to cost center spend data and are able to initiate Change Orders, review Match Exceptions and Receive on behalf of Requesters. There may be more than one worker in this role per Cost Center. |
| Costing Approver | The Costing Approver is a campus unit role responsible for approving stand-alone Assign Costing Allocations. |
| Costing Specialist | The Costing Specialist is a campus unit role responsible for initiating the stand-alone Assign Costing Allocation and the Payroll Accounting Adjustment business processes |
| Department Graduate Program Coordinator | The Department Graduate Program Coordinator is a campus unit role involved in the Academic Appointment processes for Graduate Faculty Members who will complete the Graduate Faculty Nomination Questionnaire required in the Update Academic Appointment business process to nominate graduate faculty members. |
| Effort Certification Analyst | The Effort Certification Analyst is a campus unit role assigned based on Cost Center or Cost Center Hierarchy responsible for monitoring effort reports and ensuring adherence to university reporting procedures and guidelines. This role has been assigned to Departmental Effort Coordinators/Analysts. |
| Effort Certification Reviewer | The Effort Certification Reviewer is a campus unit role assigned by Cost Center or Cost Center Hierarchy responsible for conducting administrative reviews of assigned effort reports prior to certification. This role is assigned to Departmental Effort Coordinators. |
| Equity Partner | The Equity Partner is a UMCP-specific campus role responsible for reviewing and approving job requisitions, search & selection plans, and search committees. Additionally, this role reviews finalists, ensuring there is diversity in the candidate pool. The Equity Partner is also responsible for reviewing and approving job requisition changes (e.g., cancelling a posting, updates to the search committee). |
| Gift Financial Analyst | The Gift Financial Analyst is a campus unit role who performs financial reporting functions for assigned Gifts such as manager financial reporting and metrics, and spend analytics. No initiator or approval rights - Reporting Only role. |
| Gift Manager | The Gift Manager is a campus unit role assigned as the primary manager for assigned gifts such as access to gift spend analysts and approval authority for financial business processes. |
| Grant Financial Analyst | The Grant Financial Analyst is a campus unit role who performs financial reporting functions for assigned Grants such as manager financial reporting and metrics, and spend analytics. No initiator or approval rights - Reporting Only role. |
| Grant Manager | The Grant Manager is a campus unit role is assigned at the grant level responsible for approving sponsored activity such as approving Payroll Accounting Adjustment, Payroll Costing Allocations, and Supplier Invoices. |
| HR Analyst | The HR Analysts is a campus unit role responsible for initiating staffing transactions (i.e. Create Position, Hire, Add/End Additional Job, Change Job, etc.) for a department or unit. |
| HR Divisional Partner | The HR Divisional Partner is a campus unit role responsible for reviewing and approving staffing transactions (i.e. Create Position, Hire, Add/End Additional Job, Change Job, etc.) for a division or college. |
| HR Partner | The HR Partner is a campus unit role which approves staffing transactions (i.e. Create Position, Hire, Add/End Additional Job, Change Job, etc.) for a department or unit. |
| HR Viewer | The HR Viewer is a campus unit role which has view only access into HR transactions and HR data for Workers. They do not have access to act on, update, or initiate transactions on this data. |
| I-9 Partner | The I-9 Partner is a campus unit role which reviews Section 1 of the I-9, completes Sections 2 and 3 of the I-9, and initiates the integration with e-Verify. |
| Internal Service Delivery Data Entry Specialist | The Internal Service Delivery Data Entry Specialist is a campus unit role who is responsible for performing internal service delivery data entry billing functions for assigned companies. |
| Internal Service Delivery Manager | The Internal Service Delivery Manager is a campus unit role who reviews and approves internal service deliveries created by Internal Service Delivery Specialists for assigned Internal Service Providers. |
| Journal Entry | The Journal Entry role is a campus unit role that can create manual journal entries and accounting adjustments for operational transactions. This role does not have approval authority. |
| Lead Principal Investigator | The Lead Principal Investigator is a campus unit role with reporting access at the award level to which they are assigned. |
| Manager | The Manager is a campus unit role who supervises a supervisory organization and is able to access team data, approve and edit timesheets, request time off or leaves of absence on behalf of an employee, approve and correct time offs, initiate a return from leave of absence on behalf of employees, approve and correct time offs, receive notification of team transactions and conduct performance reviews. This role may also be an initiator in certain business processes (i.e. Termination and Flexible Work Arrangement). |
| Other Investigators | Other Investigators is a campus unit role assigned to additional investigators where multiple investigators are assigned to a grant. These individuals have the ability to ability to certify Effort on behalf of an employee, approve Supplier Invoices for Subawards, and access to reporting for the assigned grant. |
| Principal Investigator | The Principle Investigator is a campus unit role which can certify effort reports on behalf of workers, approve subaward supplier invoices, and access reports for the Grant worktag to which they are assigned. Multiple Principle Investigators can be assigned to one Grant worktag. |
| Procurement Card Verification Updater | The Procurement Card Verification Updater is a campus unit role which has the ability to view all verifications for p-card holders at or below the company level to which they are assigned. Additionally, they can begin the p-card transaction verification process on behalf of a cardholder. |
| Project Financial Analyst | The Project Financial Analyst is a campus unit role who performs financial reporting functions for assigned Projects such as manager financial reporting and metrics, and spend analytics. No initiator or approval rights - Reporting Only role. |
| Project Manager | The Project Manager is a campus unit role assigned to the primary manager for the assigned project who can access project spend analytics and approval authority for expense, requisition, and timesheet business processes. |
| Recruiter | The Recruiter is a campus unit role responsible for creating Job Requisitions for both new and existing positions. This role provides details of the job, posting information (e.g., best consideration date, application materials), and corresponding documents (e.g., search & selection plan, C2 position description) before submitting the Job Requisition for approval. The Recruiter can be assigned as the "Search Recruiter" to assist the Manager and Search Committee (if applicable) with the management of candidates. |
| Search Committee Chair | The Search Committee Chair is a campus unit role assigned to the worker leading the search committee for the assigned Job Requisition. This person will lead the search committee to screen/interview applicants and then make recommendations for further interviews. |
| Search Committee Member | The Search Committee Member is a campus unit role assigned to voting members of the search committee for a Job Requisition. The member is responsible for screening/interviewing applicants and works alongside the search chair in determining finalists who should be sent to the Equity Partner. |
| Search Recruiter | The Search Recruiter is a campus unit role which helps the Manager and Search Committee (if applicable) facilitate many recruiting functions. The Search Recruiter is responsible for conducting the initial review of candidates and helps with transitioning applications to the subsequent recruitment stages (e.g., screen, interview, reference check, offer). A Search Recruiter must be assigned on each Job Requisition. This role can be assigned to the Recruiter. |
| Talent Analyst | The Talent Analyst is a campus unit role responsible for adding talent information in instances where it may be missing or changes need to be made. The Talent Analyst can also add goals to an employee’s profile if requested by the employee or manager. |
| Timekeeper | The Timekeeper is a campus unit role that will support managers with time entry tasks such as entering and/or correcting timesheets and reviewing requests to receive compensatory time off in lieu of overtime (or vice versa). When needed, the Timekeeper may also approve timesheets on a manager's behalf or initiate requests for time off on an employee's behalf. |
| USource Financial Analyst | The USource Financial Analyst is a campus unit role who performs financial reporting functions for assigned USources such as manager financial reporting and metrics, and spend analytics. No initiator or approval rights - Reporting Only role. |
| USource Manager | The USource Manager is a campus unit role assigned as the primary manager for the USource and has approval authority for financial business processes within organization. |