Workday onboarding handles the HR side of a new starter competently and then reaches a boundary. Accounts, devices and application access sit on the other side of it, owned by IT, and the handoff across that line is where most distributed teams lose their first two days.
TL;DR
- Workday owns the record and the HR process. It is not a provisioning tool and does not pretend to be.
- The handoff to IT fails in four predictable places: timing, role data, start date changes and contractors.
- A start date that moves in Workday will not move anything IT has already scheduled unless something propagates it.
- Job title is a poor key for access decisions. Most teams need a separate role field.
- Contractors frequently never enter the HR system at all, which makes them invisible to every downstream trigger.
- Workday publishes no pricing, so any per employee figure you see quoted is an estimate.
What sits on each side of the line
Workday is a system of record. It knows who is joining, when, into what job, under which legal entity and reporting to whom. For onboarding it sequences the HR tasks: contracts, documents, policy acknowledgements, payroll setup.
It does not create the directory account, configure the laptop, ship the hardware or grant application access. Those belong to identity and device tooling. The question for any team is not which system does onboarding, because both do part of it. It is what crosses between them and how reliably.
On pricing, Workday publishes no public rate at all and its pricing URL returns a 404, so figures circulating in comparison articles are third party estimates rather than published numbers. Treat them accordingly in any business case.
Failure one: the trigger fires too late
The most common configuration sends a signal to IT when the record reaches a particular state, often when the contract is signed and the record becomes active. That is correct and frequently too late for anything with a physical dependency.
A laptop that must be sourced, configured, enrolled and shipped internationally needs more lead time than a signature to start date gap usually allows. If your trigger is contract completion and your average gap is a week, device onboarding will fail routinely and the cause will look like a logistics problem.
The fix is a second, earlier signal at offer acceptance carrying only what IT needs to begin: name, start date, location and role. No contract detail, no personal data beyond the shipping requirement.
Failure two: job title is the wrong key
Access decisions usually get keyed on job title because it is the field that exists. It is a poor key, because titles are created for compensation and progression reasons and multiply accordingly.
A company ends up with a dozen engineering titles that all need identical access, and three titles containing the word analyst that need entirely different things. Any mapping built on title needs constant maintenance and drifts the moment somebody creates a new one, which nobody tells IT about.
What to do:
- Add a separate field whose only purpose is access grouping.
- Keep the list short, ideally under fifteen values.
- Make it mandatory at requisition rather than at hire.
- Review it when a new title is created, not when access fails.
- Map templates to that field, never to the title.
Failure three: the start date moves
Start dates change often, and a change in the HR record does not reach anything IT has already set in motion unless somebody built that path.
The visible version is a laptop arriving two weeks early at an address where nobody expects it. The less visible and more serious version is an account that activated on the original date and sat live and unused, which is an open credential nobody is monitoring. A start date that moves earlier is worse again, because every lead time silently shortens and the first anyone knows is a starter with nothing.
Whatever carries the original signal has to carry changes to it. A one way notification is not an integration.
Failure four: contractors are invisible
A fifty person company found its onboarding reliable for employees and chaotic for everyone else. Employees flowed through the HR record and triggered everything correctly. Contractors were engaged by individual managers through procurement and never entered the HR system at all.
So contractors got access through direct requests to whoever was nearest, with no record of what was granted. When an engagement ended there was no leaver event either, because there had never been a joiner event. An audit found eleven active accounts belonging to people whose contracts had finished, the oldest fourteen months earlier.
The fix was not a new system. It was requiring every contractor to be created in the HR record as a worker before access could be requested, which made them visible to the same triggers as everybody else.
What belongs where
| Responsibility | Owner | Crosses the boundary as |
|---|---|---|
| Who is joining and when | HR record | Early signal at offer acceptance |
| Access grouping | HR record, dedicated field | A short, stable value |
| Directory account | Identity provider | Created from the signal |
| Device and enrolment | Device tooling | Started at the early signal |
| Application access | Access management | Template keyed on the role field |
| Changes to any of the above | HR record | The same path as the original |
The question load that remains
Even a clean handoff leaves starters asking things, and most of those questions are about process rather than provisioning: which system holds what, who approves a tool, where to find a form, what a term means.
Matram is our own product and it addresses that layer rather than the handoff itself. It reads your documentation and answers questions in the channel people already use. It has no free tier, it is not an HRIS, and its actions reach HubSpot, Zendesk and webhooks only, so it can open a ticket but will not create an account, grant access or write anything back to a system of record. WhatsApp is coming soon rather than available. Pricing is flat at $29, $69 and $199 a month with unlimited seats. None of the four failures above is solved by it, which is worth saying plainly.
The checklist worth keeping
Checklist:
- An early signal to IT at offer acceptance, not contract completion.
- A dedicated access grouping field, separate from job title.
- Start date changes propagating down the same path as the original.
- Contractors created as workers before any access is requested.
- A leaver event that exists for every joiner event.
- Someone verifying access on the working day before the start date.
Final Thoughts
Workday onboarding is not usually the weak point. The boundary is, and the four failures at it are the same everywhere: the signal arrives too late, it is keyed on the wrong field, it does not carry changes, and a whole category of worker never produces one at all.
Fix the trigger timing and the contractor path first. Those two account for most of what IT experiences as unpredictable onboarding, and neither requires buying anything.
Frequently asked questions
Does Workday handle IT onboarding?
It handles the HR side: the record, the sequence of HR tasks, documents and payroll setup. Creating directory accounts, configuring and shipping devices and granting application access sit with identity and device tooling. The practical question is not which system owns onboarding but what information crosses between them and how reliably.
What should the HR system send to IT?
Name, start date, work location and an access grouping value, sent at offer acceptance rather than contract completion so there is enough lead time for anything physical. Keep it to what IT needs to begin work, since sending more personal data than necessary creates an obligation without improving the outcome.
Why not key access on job title?
Titles are created for compensation and progression reasons, so they proliferate and group poorly. A dozen engineering titles often need identical access while three titles containing the word analyst need entirely different things. A short dedicated field whose only purpose is access grouping is far more stable and far less maintenance.
What happens when a start date changes?
Unless something propagates the change, nothing downstream moves. The visible result is hardware arriving at the wrong time, and the more serious one is an account activating on the original date and sitting live and unmonitored. Any path that carries the initial signal has to carry amendments too, or it is a notification rather than an integration.
How should contractors be handled?
Create them in the HR record as workers before any access is requested, even when they are engaged and paid entirely through procurement. Without a joiner event there is no leaver event, which is how organisations end up with active accounts belonging to people whose engagements ended months earlier and nobody noticing until an audit.
How much does Workday cost?
It publishes no public rate, and its pricing URL returns a 404, so every per employee figure in circulation is a third party estimate rather than a published price. If a business case depends on one, label it as an estimate and get a quote, because the gap between estimates and quoted pricing in enterprise HCM is wide.
