Workday Writeback - Re-evaluating users

Question

I've followed this MS guide regarding the "Timing of writeback for pre-hires"

https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/workday-writeback-tutorial#timing-the-writeback-for-pre-hires

Once a new user is created in Active Directory and then synced to Entra ID, they are evaluated by Workday Writeback. Using the expression from the above article, if the EmployeeHireDate is in the future the Userprincipalname wont be written to Workday UserID.

IgnoreFlowIfNullOrEmpty(IIF(DateDiff("d", Now(), CDate([employeeHireDate])) >= 0, "", [userPrincipalName]))

This works great when Provisioning "on-demand". But I have found that the user is evaluated once when they are first created but not on future provisioning runs, so when the EmployeeHireDate comes and passes the provisioning run ignores the user. The guide mentions:

For the delayed Writeback to work as expected, an operation in on-premises AD or Azure AD must trigger a change to the user just a day before the arrival or on the hire date, so that this user's profile is updated and is considered for Writeback. It must be a change, that updates an attribute value on the user profile, where the new attribute value is different from the old attribute value.

I have used Azure Lifecycle Workflows to perform this action and a value is written extensionattribute2 in Active Directory. This syncs to Entra ID but even so the Workday Writeback provisioning run does not process the user again.

My question is, how do I get Workday Writeback to re-evaluate all users on a daily basis, or what can I update on the user profile to ensure it is considered for Writeback on their employeehiredate?

Answer 1

Hi @Daniel Spratt ,

Is sounds possible that a null attribute could be getting added. The provisioning service has a limitation that it cannot provision null attributes. - https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/known-issues?pivots=app-provisioning#null-attribute-cant-be-provisioned

You need to make sure that you are setting attribute to a value, even if it's an invalid value. You can check for null values using the expression in the documentation: IIF(IsNullOrEmpty([BusinessTitle]),"N/A",[BusinessTitle])

https://learn.microsoft.com/en-us/azure/active-directory/app-provisioning/hr-user-creation-issues

Note also that the update operation is skipped if the "Workday user account" is not present, so if the account didn't exist and you had to create it, the account won't be evaluated. For the provisioning service to again evaluate and attempt an update as part of incremental sync, there must be an update on the Azure AD user profile.

If you restart the provisioning from the portal, it will re-evaluate all users, check for differences and apply the expression logic for each user. 

If this does not apply to your situation, feel free to send me an email at AzCommunity@microsoft.com ("Attn: Marilee Turscak") and include your subscription ID and a link to this thread, and I can get a support case opened to look into why the users are not getting evaluated.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.