Microsoft Dynamics 365 F&O and Workday HCM integration

What moves between them

The main flow runs from Workday HCM into Microsoft Dynamics 365 F&O. ml-connector polls Workday for workers, supervisory organizations, and cost centers on a recurring schedule and aligns the matching records in D365, so ERP headcount and the financial dimension and department structure reflect Workday hires, terminations, rehires, and reorganizations. Workday cost centers map to D365 financial dimension values so labor and procurement entries reference valid accounts. D365 is the financial system of record, so transactional records such as posted journals and invoices are read from D365 rather than written back into Workday.

How ml-connector handles it

ml-connector stores both credential sets encrypted. For Workday it holds the OAuth2 client ID, secret, and refresh token for REST reads and the ISU username and password for SOAP, exchanging the refresh token for a fresh access token when a call returns 401. For D365 it holds the Entra ID tenant ID, client ID, secret, and the environment host, requesting a new client-credentials token each hour since no refresh token exists. Because Workday cannot push, the connector polls on a schedule, stores a last-sync timestamp per entity, and pulls records updated since the last run; entities without date filtering are fully extracted and diffed locally. Workday cost centers and organizations are mapped to D365 financial dimension values first, and the dimension display string must match the format configured in D365 or the write fails silently. D365 writes use natural keys with no idempotency header, so the connector deduplicates before posting. Both sides return HTTP 429 with Retry-After, so it backs off with jitter and retries, and every record carries a full audit trail with error replay.

A real-world example

A regional healthcare provider with around two thousand staff runs Workday HCM for hiring, organization structure, and cost center ownership, and Microsoft Dynamics 365 F&O for procurement and finance. Before the integration, an analyst exported worker and cost center changes from Workday each week and re-keyed them into D365, so new clinics and reorganized departments showed up late and procurement charges landed on stale or missing financial dimensions. With Workday HCM and Microsoft Dynamics 365 F&O connected, worker, organization, and cost center changes flow into D365 automatically and map to valid dimension values, so spend posts to the correct department from day one and the weekly re-keying step is gone.

What you can do

• •Pull workers, supervisory organizations, and cost centers from Workday HCM and align the matching records in Microsoft Dynamics 365 F&O.
• •Keep D365 headcount and department structure in step with Workday hires, terminations, rehires, and reorganizations.
• •Map Workday cost centers and organizations to D365 financial dimension values so postings reference valid accounts.
• •Bridge Workday OAuth2 refresh-token and ISU credentials with the D365 Entra ID client-credentials token.
• •Poll Workday on a schedule you control, with Retry-After backoff, retries, and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 F&O and Workday HCM?

The main flow runs from Workday HCM into Microsoft Dynamics 365 F&O. Workers, supervisory organizations, and cost centers are read from Workday and used to keep headcount and financial dimensions current in D365. Workday is the workforce system of record and D365 is the financial system of record, so transactional finance records are read from D365 rather than written back into Workday.

How does the integration handle authentication on each side?

ml-connector stores both credential sets encrypted. For Workday it uses an OAuth2 refresh-token grant for REST reads and an Integration System User with WS-Security for SOAP, refreshing the sixty-minute access token as needed. For D365 it requests an OAuth2 client-credentials Bearer token from Microsoft Entra ID against the tenant-specific environment host and renews it each hour.

If Workday has no webhooks, how is the data kept current?

Workday does not support native webhooks, so ml-connector polls on a schedule, with a recommended minimum interval of five minutes for background sync. It records a last-sync timestamp per entity and pulls only records changed since the previous run, falling back to full extraction and local diffing for entities that lack date-range filtering. It backs off with jitter when Workday returns HTTP 429 with a Retry-After header.