University of Arkansas | Workday Security
Workday Proxy Access Standard
Workday proxy access is restricted elevated access and is not a standard entitlement for testing, training, troubleshooting, reporting, or general Workday support.
Important: Proxy access is granted only when a documented business need cannot reasonably be met through a lower-risk alternative and all required approvals have been completed. Approval is not guaranteed based on job title, previous access, convenience, or prior use of proxy.
|
What it is
Workday Proxy Access
Proxy allows an authorized user in a non-production Workday environment to act as another Workday user for testing or validation purposes. |
Why it is limited
Restricted Elevated Access
Proxy may expose information and functionality beyond the requester's normal Workday security. UAF therefore significantly restricts its use. |
1. Before Requesting Proxy Access
Do not request proxy access if one of these approaches can reasonably meet your need:
| Need |
Preferred Approach |
| Troubleshoot what another user sees |
Meet with the user in Microsoft Teams and have the user share their screen. |
| Assist the user directly |
Use an approved remote-support method where appropriate. |
| Understand an error |
Obtain screenshots and error details without unnecessarily capturing sensitive data. |
| Develop training |
Work with the SME or process owner to capture approved screenshots and create training material. |
| Validate a process |
Have an appropriately secured user execute the scenario and provide results. |
| Confirm access/security |
Use security configuration, role/domain analysis, or an authorized tester where possible. |
| Validate a report |
Use report/security analysis first; where necessary, coordinate controlled testing with an authorized user. |
| General exploration or learning |
Use documentation, training resources, demonstrations, or guided testing. |
2. Why Proxy Access Is Restricted
Workday's non-production environment holds a working copy of real employee data. University and UA System policy protect that data regardless of environment.
UAF Data Classification (FPP 921.0) and Data Management, Use and Protection (FPP 922.0)
Access to sensitive data must be limited to those with an official, documented need in every environment.
FERPA and UA System Board Policy 540.1
Student education records remain protected in test and training systems.
UA System Board Policy 285.1 and the University's Code of Computing Practices
Sensitive information must be protected from unauthorized access regardless of environment.
NIST SP 800-53
Least-privilege and account-management guidance supports restricting privileged-style access to a specific, named set of people and reviewing it on a recurring basis.
3. When Proxy Access May Be Approved
Proxy is not standard access. Most Workday support, troubleshooting, reporting, training, and testing needs should be completed using the preferred approaches described above.
Most users will not need an exception.
Proxy access has a limited established use for approved User Acceptance Testing (UAT). Requests outside this use are expected to be rare and must be evaluated to determine whether an exception is appropriate.
| Approved Use |
Standard / Approval Requirement |
| New / Modified Process Testing (UAT) |
Named testers participating in an approved UAT effort may receive temporary proxy access when proxy is necessary to execute the defined test scenarios. Access is limited to the approved testing window and ends when the testing need is complete or at go-live. |
Other Exceptional Business Needs
If a business need cannot reasonably be met through one of the preferred alternatives above and does not fall within approved UAT, it must be evaluated as an exception.
Exception Process: Pending
Until the formal exception process is published, submit the business need through TDX for review by Security Governance. Security Governance will determine whether the request should proceed for exception consideration.
Requesting an exception does not guarantee approval. The business justification must clearly explain why available alternatives cannot reasonably meet the need and why proxy access is necessary.
Questions? Contact Workday Support Services (WSS) or Security Governance through TDX.
```