How to Connect Workday GPC to Deel

This guide provides a comprehensive, step-by-step walkthrough for connecting your Workday Global Payroll Cloud (GPC) integration to Deel. These steps apply to all supported worker types, including Global Payroll (GP), EOR (Employer of Record), and PEO.

Setup type: Managed

A dedicated Deel System Integration Manager (SIM) will lead the setup process. A typical rollout covering 3 countries takes 6–12 weeks. Contact your Deel representative to begin.

In this article

• Before you begin
• Supported contract types
• Connecting Workday to Deel
  • Step 1: Create and configure an ISU
  • Step 2: Configure security
  • Step 3: Create an API Client
  • Step 4: Generate a Refresh Token
  • Step 5: Connect Workday to Deel
• Setting up DCoD
  • Step 6: Create an Integration System
  • Step 7: Register Deel as an External Payroll Vendor
  • Step 8: Create External Payroll Vendor Mapping
• Activating domains for optional plugins
  • Step 9: Activate the required domains
  • Step 10: Assign users or groups to domains
  • Step 11: Activate pending security policy changes
• Next Steps
  • Step 12: Choose your configuration path
• Configure plugins and data sync

Before you begin

Make sure that:

• You have ​​a Deel account and are logged in.
• Admin access to Deel (e.g., Integration Administrator, Payroll Interface Administrator, or Payroll Integration Administrator permissions).
• Your Deel environment is configured as such:
  • Entities and pay groups must be active.
  • Global Payroll must be enabled for relevant entities.
• Have a Workday GPC and are logged in.
• Your Workday environment is configured as such:
  • GRID must be enabled for your Workday tenant (Contact your Workday representative to enable this).
  • Workday Payroll Interface and a Third-Party Payroll Organization must be set up.
  • Third-Party Pay Groups must be configured with the option "Used in Payroll Interface" enabled.
  • Earnings and Deductions must be defined for Third-Party Payroll.
• You prepare a list of fields to be mapped. If syncing PTO, One-Time Payments (OTP), or recurring payments, consult your Deel representative first to enable these features.
• (Optional) If you are currently using the External Payslips REST API and wish to set up ExPD, you must disable the existing API first.

Supported contract types

The procedure described on this page can be used to set up the integration for the following contract types:

• Global Payroll (GP)
• Employer of Record (EOR)
• PEO (Professional Employer Organization)

Connecting Workday to Deel

Step 1: Create and configure an ISU 

The integration requires a dedicated Integration System User (ISU) to communicate securely between Deel and Workday.

1. Go to the Workday GPC platform.
2. Search for the Create Integration System User task and click the result to create one.
3. Set the credentials as below and click OK to confirm.
   • Username: ISU_Deel 
   • Define a new password or check the box to allow the system to create a random password.
   • Check Do Not Allow UI Sessions.

For more information, visit the Create Integration System User for Data Changes on Demand documentation in the Workday Community.

Step 2: Configure security 

1. Search for the Create Security Group task and click the result to create one. 
2. Select Integration System Security Group (Unconstrained) and enter a username for the group. You are prompted to edit the Security Group.
3. Add the ISU you just created under Integration System Users. Click OK to confirm. 
4. Search for the Maintain Permissions for Security Group task and click the result. Set the Security Group you just created as the Source Security Group and click OK.
5. In the Domain Security Policy Permissions tab, add the following policies with GET and PUT access (required for all worker types):

Additional permissions by contract type

If you are setting up these contract types:

• Global Payroll - also add GP-specific permissions
• Employee of Record - also add EOR-specific permissions
• PEO - the core permissions above are sufficient.

6. Search for and run the task Activate Pending Security Policy Changes. Enter a comment to describe the security changes and click OK. Check Confirm and click OK again to publish the changes. 

For more information, visit Create Integration System User for Data Changes on Demand in the Workday Community.

Step 3: Create an API Client

To allow Deel to access your Workday data via OAuth 2.0, you must register Deel as an API client. 

Additional scopes by contract type

If you are setting up these contract types:

• Global Payroll - also add GP-specific scopes
• Employee of Record - also add EOR-specific scopes
• PEO - the core DCoD scopes are sufficient.

1. Search for and launch the Register API Client for Integrations task.

2. Set the following configuration: 
   • Client Name: Deel Integration
   • Non-Expiring Refresh Tokens: Selected
   • Scope (Functional Areas): All the scopes necessary for the features you want to use. Refer to the Scopes reference table to find an extensive list. To use DCoD, enter the following scopes: Contact Information, Global Payroll Connect, Integration, Payroll Interface, Staffing, System, Tenant Non-Configurable. 
   • Include Workday Owned Scope: Selected
3. Click OK and review your settings.
4. Once saved, Workday will provide a Client ID and Client Secret. Save these immediately, as the secret will not be shown again.
5. Click Done to conclude. 

For more information, visit Register API Clients for Integrations in the Workday Community.

Step 4: Generate a Refresh Token

Deel requires a Refresh Token to maintain a persistent connection without manual re-authentication.

1. In Workday, search for View API Client and click to go to the report.
2. Copy the URL in Workday REST API Endpoint and store it for future use. Some parts of the URL will be needed to connect to Deel. For more information, see URL breakdown.

3. Locate the API client previously created and go to API Clients for Integrations, then click the Related Actions menu next to the API client name > API Client > Click Manage Refresh Tokens for Integrations. 

4. Set your ISU as the Workday Account and click OK. 
5. Generate a new Refresh Token and copy the value.

For more information, visit the Next Steps section in Register API Clients for Integrations in the Workday Community.

Step 4: Connect Workday to Deel

Now, move to the Deel platform to establish the link.

1. Log in to Deel and find the Workday GPC integration in the Apps hub.
2. Click Connect and enter your Workday credentials:
   • The base URL retrieved when generating the refresh token. 
   • The tenant. This can also be found in the URL.
     1. Refer to URL breakdown to understand which part of the URL is needed.
   • The client ID and client secret retrieved when registering the API client
   • The refresh token generated earlier
   • The public x509 key retrieved earlier
3. Select the Worker Types you wish to include in this integration (GP, EOR, or PEO).

Setting up DCoD 

The following steps cover the technical setup within Workday required to enable Data Changes on Demand (DCoD). These steps must be completed to allow Deel to pull core HR, compensation, and payment data.

The next steps are required if:

You are using DCoD-dependent plugins, such as:

• People Data Sync
• OTP
• Recurring Payments
• PTO
• GPH
• APD

You can skip this section if you are only setting up ExPR, ExPD, or Cost Center Sync.

Step 6: Create an Integration System

This creates the technical container for the DCoD data flow.

1. Launch the Create Integration System task.

2. Enter a name for the system. 
3. Select Data Changes on Demand as the Template.
4. Click OK to save.

Refer to Workday Community's Create Integration System documentation for more information.

Step 7: Register Deel as an External Payroll Vendor

Before Deel can pull worker data, it must be recognized as an authorized vendor within your Workday tenant.

For all use cases except ExPD.

1. Search for and launch the Create External Payroll Vendor task.
2. Enter a name and add features for the External Payroll vendor. Select Data Changes on Demand.

Additional scopes by contract type

If you plan on using the Global Payroll Hub or syncing Payroll Results, you should also add Global Payroll Hub and External Payroll Results to this list.

3. Click OK, then click Done.

Step 8: Create External Payroll Vendor Mapping

This links the Deel vendor to your specific Workday environment and establishes encryption.

1. Launch the Create External Payroll Vendor Mapping task.
2. Select the Deel vendor created in the previous step and choose your environment (e.g., Production). Click OK.
3. Under Public Private Key Pairs, create a new x509 Private Key Pair:
   • Give it a name.
   • Select Do Not Allow Regeneration for security.
4. Click OK, then set the key to Active.
5. Under Feature Configuration, add the Data Changes On Demand feature, and configure the following attributes:
   • Acknowledgement Endpoint: Enter the URL that can be found on the Deel GP People Data Sync Plugin > Additional Settings > Acknowledgement Endpoint URL.
   • Integration System User: Select the ISU you previously created.
   • Integration System Endpoint: Select the Integration System created in the previous step. 

6. Click OK.

Activating domains for optional plugins

Some plugins require additional domain security policies to be active in Workday before they can be enabled in Deel. Each time you enable a new plugin, complete the steps below for that plugin before proceeding to its setup guide.

To find out which domains are required for the plugin you are setting up, refer to the Security permissions reference and locate the column for your plugin.

Step 9: Activate the required domains

1. Search for the domain using the domain: prefix. For example, domain: Set Up: Payroll Interface.
2. In the Domain Security Policy section, use the related actions to go to Domain Security Policy > Enable.

3. On the following screen, confirm the enablement.
4. Repeat for any remaining domains required for your plugin.

Already active?

If a domain is already active, skip it and move to the next one.

Step 11: Assign users or groups to domains

1. Open the domain.
2. In the Domain Security Policy section, use the related actions to go to Domain Security Policy > Edit Permissions.

3. In the Report/Task Permissions section, check that the required security groups are present. If any are missing, add them.

4. Save your changes.

To add users to the relevant security group, use the Assign Users to User-Based Security Group task.

Step 12: Activate pending security policy changes

1. Launch the Activate Pending Security Policy Changes task.
2. Enter a comment describing the reason for the change and save.

For more information, visit Activate Pending Security Policy Changes in the Workday Community.

Next Steps

Step 13: Choose Your Configuration Path

Now that the common technical connection between Deel and Workday GPC is established, you must configure the specific data flows for your workforce. Because Workday handles Global Payroll, PEO, and EOR contracts through different technical frameworks, the setup procedures now branch out.

Configure Plugins and Data Sync

Select the guide below that matches your contract types to complete the integration:

• Setting Up Workday GPC for Global Payroll (GP) - Choose this if you manage your own entities and require deep, bi-directional payroll synchronization using the Workday GPC framework.
• Setting Up Workday GPC for PEO Contracts - Choose this if you use Deel’s PEO services for your US-based employees and want to automate employee creation and profile updates.
• Setting Up Workday for EOR Contracts - Choose this if you have employees legally employed by Deel and want to sync Time Off and link profiles via the People Match plugin.

Configuration changes for each contract type

If you manage multiple contract types (e.g., both GP and PEO), you will need to complete the configuration steps for each relevant branch. All configurations use the same Integration System User (ISU) created in the previous steps.