Should I use a service account or my own login?
Updated 2 weeks ago
Use a dedicated service account (also called an integration user or integration system user) whenever your HR system supports one. A connection made with a personal login breaks when that person changes their password, loses access or leaves the company, and you then have to reconnect.
Why a service account works better
It doesn't expire with a person. Connections that keep asking to be reconnected almost always use a personal account that's subject to password rotation or offboarding. A service account fixes this for good.
You control exactly what it can see. You give the account only the permissions the integration needs, instead of everything an admin can see.
It doesn't go through a person's sign-in flow. In Workday, for example, the integration user's security group uses a credential-based authentication policy, so it doesn't go through the multi-factor or single sign-on steps your employees use.
What to set up
Create the service account in your HR system. Your system's setup guide names the account type to use.
Give it a role or security profile with the permissions listed in the setup guide.
Make sure it can see every employee you want to sync, for example all companies or locations.
Connect using the service account's credentials, not your own.
Examples by system
System | What to use |
|---|---|
Workday | An Integration System User (ISU) in a security group with the required domain permissions. You can turn on Do Not Allow UI Sessions for the ISU: it blocks the account from signing in to the Workday interface and doesn't affect the integration. |
UKG Ready | A service account linked to a security profile created for the integration. |
SAP SuccessFactors | A dedicated integration user with its own permission role and permission group. |
Permissions are checked on the account used to connect, not on the admin who set it up. If data is missing after you connect, check the service account's role first.