Sso on OfficeConnectPro

Sign In & Create Your First Tenant

Mon, 01 Jan 0001 00:00:00 +0000

A tenant in Workday OfficeConnect is a saved connection to a Workday instance. You create it once, and OfficeConnect remembers it for future sessions.

What you’ll need

Before you start, gather these details from your Workday administrator:

Detail	Where to find it
Client ID	Workday OfficeConnect API client
API Endpoint URL	Workday OfficeConnect API client
Authorization Endpoint URL	Workday OfficeConnect API client

If your admin hasn’t yet generated these, see Set Up Workday SSO.

Configure

Mon, 01 Jan 0001 00:00:00 +0000

Tenant configuration, single sign-on, and the network plumbing OfficeConnect needs to reach Workday Adaptive Planning.

Articles in this section

Sign In & Create Tenant — Sign in to Workday OfficeConnect for the first time and configure your Workday tenant connection
Multiple Instances — How to switch between production, sandbox, and multi-instances in Workday OfficeConnect
Workday SSO — Configure Workday OfficeConnect to use Workday Single Sign-On for your organization
SSO with Okta — Configure Okta to authenticate Workday OfficeConnect users via Workday SSO — application setup, claim mapping, MFA pairing, and the common failure modes
SSO with Microsoft Entra ID — Configure Microsoft Entra ID (formerly Azure AD) to authenticate Workday OfficeConnect users via Workday SSO — enterprise application setup, claim mapping, and Conditional Access tuning
Refresh with Power Automate — Use Power Automate Desktop to schedule Workday OfficeConnect report refreshes automatically — keep distributed Excel reports up to date without manual intervention

Fix Authentication and Token Errors in OfficeConnect

Mon, 01 Jan 0001 00:00:00 +0000

Token and sign-in errors usually mean the SSO session has lapsed or the tenant configuration has drifted. Confirm Workday OfficeConnect is pointed at a valid tenant on Sign In & Create a Tenant, and review your Workday SSO configuration if multiple users hit the same error.

Symptom

One or more of the following:

OfficeConnect shows an error message containing words like “Authentication failed”, “Token expired”, “Unauthorized”, or “401”
The sign-in browser window opens but returns an error after you authenticate
OfficeConnect repeatedly asks you to sign in even after a successful authentication
Refresh fails immediately with an authentication-related error rather than a network error

Causes

The Workday SSO session has expired and the access token needs to be refreshed
The OfficeConnect client ID or tenant configuration is incorrect or has changed
A browser cookie or cached token is corrupted, preventing new authentication from completing
The Workday tenant’s OAuth application for OfficeConnect has been disabled or its credentials rotated
Multi-factor authentication (MFA) requirements have changed and OfficeConnect’s browser flow isn’t handling the new MFA step

Fix 1: Sign out and sign back in

The fastest fix for most token errors is a clean sign-out and re-authentication.

Set Up Workday SSO

Mon, 01 Jan 0001 00:00:00 +0000

For admins & power users This page requires Workday Security Administrator access. End users don’t need to do anything — SSO is configured at the tenant level by admins and power users.

What Workday SSO does for OfficeConnect

With SSO enabled, users sign in to Workday OfficeConnect using their existing Workday credentials through your identity provider. They don’t need a separate Adaptive Planning username and password.

For identity-provider-specific guides, see SSO with Okta, SSO with Microsoft Entra ID, or SSO with Ping Identity (coming soon under Admin → Configure).

Single Sign-On for Workday OfficeConnect with Okta

Mon, 01 Jan 0001 00:00:00 +0000

For admins & power users Requires Okta administrator access and Workday Security Administrator access. End users don’t change anything on their side; this is a tenant-level configuration.

Workday OfficeConnect doesn’t authenticate to Okta directly. Instead, OfficeConnect authenticates to Workday, and Workday uses Okta as its identity provider. This indirection is important — the configuration lives on the Workday side, not directly in OfficeConnect — and explains why many SSO problems surface as Workday auth failures rather than Okta errors.

Single Sign-On for Workday OfficeConnect with Microsoft Entra ID

Mon, 01 Jan 0001 00:00:00 +0000

For admins & power users Requires Entra ID Application Administrator (or higher) and Workday Security Administrator access. End users don’t change anything; this is a tenant-level configuration.

Workday OfficeConnect doesn’t authenticate to Microsoft Entra ID directly. OfficeConnect authenticates to Workday, and Workday uses Entra ID as its identity provider. The configuration sits on the Workday side, with Entra ID providing the SAML or OIDC backbone.

This guide assumes Entra ID-to-Workday SSO is already working for the Workday web app. If not, do that integration first (Entra’s enterprise app gallery has a “Workday” SAML template).