Before
IAM had to compare the employee's former and new team access, review application usage, and identify sensitive or conflicting permissions manually. The team also had to contact both managers separately, record their decisions, coordinate changes across applications, and track deferred removals or follow-up tasks.
How it works
- Receive the Workday transfer, compare old and new access evidence, and validate the account, groups, applications, usage, and separation-of-duties signals.
- Ask the incoming and outgoing managers to certify new access and former-team retention, recording approvals, selections, or timeouts on the request.
- Apply approved changes, schedule or task exceptions, verify group membership, close the request, and send both managers a recap.
Workflow details
- Trigger and evidence review: A Workday team-transfer event starts the process with the employee, old and new teams, managers, and effective date. The workflow compares the employee identity and team groups with directory evidence, reviews application differences and recent use, and checks for sensitive or incompatible responsibilities.
- Validation and exception handling: Before any write action, the workflow verifies account identifiers, team-group matches, application data, and required evidence. If the analysis is incomplete or unreliable, it creates an IAM manual-review request and applies no access changes.
- Manager certification: The incoming manager reviews the proposed access package, while the outgoing manager chooses removal on the effective date or a 30-day handover for former-team access. Decisions or missed deadlines are recorded on the transfer request, and a missed deadline does not grant new access.
- Execution and closure: The approved plan adds or removes team memberships, handles direct application memberships where supported, and creates IAM tasks or scheduled expiry records for other changes. The workflow verifies resulting group membership, records the actions, closes the request, and sends both managers a recap.
What changed
One Workday transfer now creates a shared, evidence-checked review for both managers, automatically records their decisions, applies supported changes sequentially, schedules or assigns unsupported work, and routes evidence gaps to IAM before any access action is taken.
Work removed
IAM no longer needs to manually reconcile old and new group and application lists, investigate usage one item at a time, chase two manager decisions, copy decisions into the request, coordinate individual access changes, or prepare separate status recaps.
Expected outcome
Each transfer produces an auditable access decision and execution plan while conservatively removing at least three recurring manual handoffs: access comparison, manager follow-up, and change coordination.
