Workday integrations and apps that keep working after each feature release.
Workday tenants pile up integrations the way old ERPs piled up custom code. There are EIBs nobody owns, Studio projects only one person can open, and reports doing integration work. We rebuild the fragile ones in Orchestrate and build what's missing in Extend. Everything gets tested before each release.
Cohash builds and supports Workday integrations and extensions.
We work in EIB, Workday Studio and Orchestrate, build Workday Extend apps and agents, and run Prism Analytics and Data Cloud pipelines with the security and business process configuration around them. At Rising in October 2026, Workday opened its developer program to anyone, with free developer docs and a beta for personal development tenants. We test each integration against every twice-yearly feature release before it goes live.
you probably need this if
Payroll or benefits feeds broke after the last feature release and nobody tested them in preview.
There are EIBs and Studio integrations in production that nobody can explain.
There's no app for one Workday process, so a business team runs it in a spreadsheet.
19 Sep 20262026R2 feature release The second of Workday's two feature releases in 2026 reached production on 19 September 2026. source ↗
13 Oct 2026Extend AI tools generally available Workday Extend AI now has Developer Agent, Custom Agents and Agent-Ready Tools generally available. Workday partners with Anthropic, and that's how Developer Agent connects to Claude. source ↗
today · Oct 22, 2026
no date yetWorkday Developer Program opened to allAnnounced at Workday Rising (12 to 15 October 2026). APIs, MCP tools and developer docs are open without login, anyone can join with a personal email, and personal development tenants are in open access beta.source ↗
no date yetPrism and Data CloudWorkday says Data Cloud won't replace Prism. What Data Cloud adds is zero-copy access, and outbound sharing of Prism datasets is targeted to be fully available in 27R1.source ↗
the story · workday estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Workday estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · workday estate3 open
openPayroll or benefits feeds broke after the last feature release and nobody tested them in preview.
recurringThere are EIBs and Studio integrations in production that nobody can explain.
blockedThere's no app for one Workday process, so a business team runs it in a spreadsheet.
exposure
Integration build and rebuildWorkday Extend appsAgents on WorkdayPrism Analytics and Data CloudFeature release testingStaffing
startrehearsehandover
Integration and tenant review
Rebuild plan
Build and preview test
Run and hand over
we are here
ready to hand over
Integrations are documented and owned, and the next feature release is tested before it…
Managers get drafted requests.
Integration register with owner, schedule, ISU and failure history per flow
Orchestrate rebuild plan ranked by business impact
chapter 01 · where it hurts
Why teams reach out
Payroll or benefits feeds broke after the last feature release and nobody tested them in preview.
There are EIBs and Studio integrations in production that nobody can explain.
There's no app for one Workday process, so a business team runs it in a spreadsheet.
chapter 02 · what we change
How we solve it
Integration build and rebuild
Workday Extend apps
Agents on Workday
Prism Analytics and Data Cloud
Feature release testing
Staffing
chapter 03 · how it runs
Our approach
Integration and tenant review
Rebuild plan
Build and preview test
Run and hand over
chapter 04 · where you end up
What changes
Integrations are documented and owned, and the next feature release is tested before it reaches payroll or benefits.
Managers get drafted requests.
Integration register with owner, schedule, ISU and failure history per flow
Orchestrate rebuild plan ranked by business impact
what we do
Our Workday work
6 kinds of Workday work, each run by engineers who have done it on live tenants.
EIB for simple loads, Orchestrate for new event-driven and API-to-API flows, and Studio for the complex legacy cases. Each one gets an owner, an integration system user and error alerts.
Custom apps, business objects and orchestrations built in Workday Extend, with security domains designed alongside so the app follows the tenant's access model.
Extend AI custom agents and agent-ready tools scoped to specific tasks, with Workday permissions and approvals deciding what each agent can read and change.
Prism datasets that blend Workday and external data for reporting, and zero-copy sharing with Snowflake or Databricks where the data platform should own it.
Regression testing in the preview tenant before each March and September feature release, focused on integrations, business processes and security changes.
Workday integration developers, Extend developers, Prism specialists and HCM or Financials functional consultants on contract, contract-to-hire or permanent terms.
capability 01 / 06in production
Integration build and rebuild
EIB for simple loads, Orchestrate for new event-driven and API-to-API flows, and Studio for the complex legacy cases. Each one gets an owner, an integration system user and error alerts.
Custom apps, business objects and orchestrations built in Workday Extend, with security domains designed alongside so the app follows the tenant's access model.
Extend AI custom agents and agent-ready tools scoped to specific tasks, with Workday permissions and approvals deciding what each agent can read and change.
Prism datasets that blend Workday and external data for reporting, and zero-copy sharing with Snowflake or Databricks where the data platform should own it.
Regression testing in the preview tenant before each March and September feature release, focused on integrations, business processes and security changes.
Workday integration developers, Extend developers, Prism specialists and HCM or Financials functional consultants on contract, contract-to-hire or permanent terms.
We pieced these together from Workday situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Ninety integrations, three of them Studio projects nobody can open
composite · not a client story
Beforethe situation
A Workday tenant runs about ninety integrations across EIB, Studio and connectors. Three critical Studio projects were built by a former contractor, and the September release broke a benefits feed.
What we dothe work
We build an integration register straight from the tenant and fix the benefits feed in preview first. Then we reverse-engineer the three Studio projects and rebuild them in Orchestrate, each with error alerts and a named owner. A preview regression pack is in place before the March release.
Afterwhere you end up
Integrations are documented and owned, and the next feature release is tested before it reaches payroll or benefits.
case file 02
An HR team asking for an agent that drafts job changes
composite · not a client story
Beforethe situation
HR business partners want an agent that drafts job change requests from manager notes. Security's question is simple: can the agent see compensation for people outside the manager's org?
What we dothe work
We build the agent in Extend AI against agent-ready tools, so it runs under the requesting user's Workday permissions. Test cases use managers from different supervisory orgs. Every draft still goes through the standard job change business process before anything changes.
Afterwhere you end up
Managers get drafted requests. The agent sees only what the person asking could already see.
We don't start a step until the last one has produced something you can check.
step 01
Integration and tenant review
We put every integration system and EIB, Studio and Orchestrate flow on one list, with owner, schedule and failure history. Then we review the integration security groups and Extend apps in the tenant.
step 02
Rebuild plan
Fragile integrations get ranked by business impact. New and rebuilt flows go to Orchestrate where it fits. We only keep Studio where it's genuinely still the right tool.
step 03
Build and preview test
We build apps, integrations and agents in a sandbox or personal development tenant and test them against the preview tenant before each feature release.
step 04
Run and hand over
Alerts, runbooks and an integration register for your team, plus a release-testing checklist for March and September.
ai on workday
Where AI fits on Workday, and where it needs guardrails.
Builders know Workday's AI as Workday Extend AI. Developer Agent, Custom Agents and Agent-Ready Tools are generally available. After Rising in October 2026, the APIs, MCP tools and developer docs no longer need a login to read. There's also a new Anthropic partnership connecting Developer Agent to Claude. For us, most of the engineering is keeping agents inside Workday security and its business processes.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
Workdaydoes the work
Workday publishes MCP tools next to its APIs, and they're readable without a login. Agents run under Workday security groups, permissions and approvals, as an integration system user or in the requesting user's context. We scope each agent separately, test with real security groups, and rely on Workday's audit trail for changes.
Custom Agents and Agent-Ready Tools
Custom Agents work on Workday data through Agent-Ready Tools that follow Workday permissions and approvals. Each agent we build does one task and runs under the requesting user's security. Changes go through the normal business process, which means a drafted job change still needs a person's approval.
Developer Agent
Developer Agent works in Claude Code, Cursor, VS Code and Google Antigravity to help build Extend apps and integrations. We use it in sandboxes and personal development tenants, with code review and tests against the preview tenant before each feature release.
Agent Passport
Agent Passport, in early access, lets IT teams verify agents that work with Workday. We'd pilot it alongside your identity governance tool so each agent has an owner and a review date.
Open developer program
Workday's developer program now takes anyone with a personal email, and personal development tenants are in open access beta. Prototyping agents and training new developers no longer means touching a customer tenant.
Where Workday connects to identity, payroll, data and agents
Workday is the source of truth for workers. Orchestrate and Studio carry hire and change events to identity, payroll and finance systems. Data Cloud shares data to analytics platforms without copies, and Extend AI agents work inside Workday's permission model.
01 · Workday tenant
Workday HCM and Financialsworkers · ledgers · BPs → Orchestrate and Studio · business events→ Snowflake · Data Cloud share
Workday Extendapps · Extend AI agents → Workday HCM and Financials · business objects
02 · Integration
Orchestrate and Studioevents · APIs · files → SailPoint · worker changes→ Payroll and benefits · payroll inputs
EIBbulk loads → Workday HCM and Financials · bulk load
These are working documents, written against your configuration, so your team can run them without us.
inventory01
Integration register with owner, schedule, ISU and failure history per flow
yours to keep
plan02
Orchestrate rebuild plan ranked by business impact
yours to keep
tests03
Preview tenant regression pack for each feature release
yours to keep
design04
Extend app design with security domains and business objects
yours to keep
tests05
Agent scope and permission design with test results by security group
yours to keep
design06
Prism or Data Cloud data-sharing design per dataset
yours to keep
talent and delivery · workday
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Workday work. The ones who've done it answer differently from the ones who've read about it.
Q1
Which of our integrations belong in Orchestrate, and which should stay in Studio or EIB?
Rebuilding everything is wasted effort. Leaving fragile Studio projects alone keeps the risk where it is. Decide integration by integration.
Q2
Will you test our integrations in the preview tenant before each feature release, and how?
Workday ships two feature releases a year, each with a preview window. Breaks are cheapest to catch there, before payroll finds them.
Q3
How does each agent inherit Workday security, and how will you prove it?
An agent should be able to do only what the user asking is allowed to do. Test with real security groups and you'll see whether it does.
Q4
Which data should stay in Prism and which should go to our data platform through Data Cloud?
Duplicate pipelines leave you with two versions of headcount and cost. Decide dataset by dataset where each one lives.
Q5
Will you prototype in a personal development tenant before touching our sandbox?
Workday now has personal development tenants in beta. Prototyping in one keeps experiments out of shared environments.
01EIB, Studio or Orchestrate for a new integration?
EIB for simple inbound or outbound file loads. Orchestrate for most new integrations, especially event-driven flows from business processes and API-to-API calls. Studio is still there for complex legacy cases. We pick per integration based on volume, logic and who will support it.
02What did Workday's open developer program change?
At Rising in October 2026, Workday opened its developer docs, APIs and MCP tools without a login. Anyone can join the program with a personal email, and personal development tenants went into open access beta. It's easier to prototype now, and you can train new developers without borrowing a customer tenant.
03How do we keep integrations working through feature releases?
Workday ships two feature releases a year, in March and September, with a preview window before each. We run a regression pack on the preview tenant covering every production integration, the business processes they trigger and security changes in the release notes.
04Should we use Prism or share data to Snowflake or Databricks?
Both, often. Prism suits data that needs Workday security and reporting inside the tenant. Data Cloud zero-copy sharing suits data your analytics platform should own. Workday's own guidance treats them as complementary, so it's a dataset-by-dataset call.
05Can agents act on Workday data safely?
Yes. Extend AI agents and agent-ready tools run under Workday's permissions, approvals and audit trail. Each agent gets its own scope, and we test it with real security groups before production.
06Do you also cover PeopleSoft to Workday moves?
Yes. We map PeopleSoft data and customizations to Workday, build the conversion loads and integrations, and run parallel payroll before cut-over.
services
Related services
Projects on Workday usually end up touching one of these, so they're worth a look.
