Automated Joiner-Mover-Leaver Playbook with Workday and Okta

Overview

This document provides a step-by-step, walkthrough for configuring and using Joiner–Mover–Leaver (JML) Playbooks in BalkanID. It covers the complete setup flow from integrating your HRIS and Microsoft Entra ID, to configuring webhooks with HRIS and n8n, and finally executing playbook actions that automatically create, route, and approve access requests based on defined policies.

While this guide is specific to Workday and Okta, the same concepts apply to other HR systems and applications for which provisioning & de-provisioning are supported by BalkanID.

What Are JML Playbooks?

JML Playbooks in BalkanID allow you to automate identity and access workflows triggered by employee lifecycle events such as:

• Joiner: A new employee starts

• Mover: An employee changes role, department, or title

• Leaver: An employee exits the organization

Playbooks can automatically:

• Create access requests

• Route requests for approval or auto-approval based on policy

• Trigger provisioning and deprovisioning workflows

• Maintain a complete audit trail within your BalkanID tenant

Playbooks can be triggered in real time via webhooks or run automatically based on defined conditions, providing consistency, speed, and governance across identity workflows.

Pre-requisites

Before you begin, ensure the following are in place:

• An active BalkanID tenant accessible at https://<yourdomain>.app.balkan.id

• Administrator access in Workday (or your HRIS) to configure API keys and webhooks

• Global Administrator access in Okta for integration setup

• An active n8n instance (cloud-hosted or self-hosted)

This guide uses n8n-based workflows as an example, BalkanID playbooks supports multiple workflows. If you use a different workflow orchestration platform or custom scripts, please contact BalkanID Support: [e-mail]

Integration Setup

1. Configure HRIS - Workday Integration

1. Log in to <yourdomain>.app.balkan.id

2. Navigate to Configure → Integrations

3. Click Add Integration

   
4. Search for and select 'Merge'

5. Provide a description and assign an owner

   
6. Click on 'Get Access Token'

7. Search for 'Workday' and select the Workday module

8. Follow the instructions on setting via credentials or via SFTP

   
9. Click on next to move onto Optional Configuration.

   1. Fill Optional configuration, if required.

      
   2. Once you filled in the information, click Save. Your integration is now configured and you will see the status of the integration displayed alongside other integrations on the Integrations page. When data is available, the integration Status will read Connected and the integration Message will read Data available.

2. Configure Okta Integration

BalkanID recommends using a dedicated service account for Okta integrations instead of a personal user account.

Follow the official setup guide here:

• Okta Integration Setup

This integration enables BalkanID to evaluate identity attributes, roles, and group memberships required for access decisions.

Webhook Configuration: Workday ↔ n8n

n8n Playbook Setup

1. Download the playbook JSON file provided by the BalkanID team. If you have not yet received the file, please contact [e-mail] to request it.

2. Import the workflow into your n8n instance

3. Configure credentials:

   • Create a new BalkanID API Key from <yourdomain>.app.balkan.id → Account → API Keys and use it in playbook configuration

   

   • Workday credential using the API key created in the next step

4. Initialize configuration variables in the workflow nodes

5. Activate the workflow

Once active, the n8n workflow listens for HRIS events and triggers the appropriate BalkanID playbook.

Workday API and Webhook setup

Workday supports event-driven outbound integrations that function as webhooks for lifecycle events.

Step 1: Create an Workday API Key

Create Integration System User (ISU): Search in Workday: Create Integration System User Username: n8n_integration_user Password: ******** Save

Create Integration Security Group: Search: Create Security Group Type: Integration System Security Group (Unconstrained) Name: BalkanID_Workday_API

Assign User to Security Group: Search: Assign Integration System Security Group User: n8n_integration_user Group: BalkanID_Workday_API

Grant API Permissions: Search: Maintain Permissions for Security Group

Core Worker Data: Worker Data: Public Worker Reports Worker Data: Current Staffing Information Worker Data: Employment Data

Optional: Worker Data: Organization Information Worker Data: Compensation

Activate Pending Security Policy Changes

Enable API Access (Domain Security Policy): Search: View Security for Securable Item Search for: Worker Data Ensure: GET access

Get Workday API Endpoint: https://{tenant}.workday.com/ccx/api/v1/{tenant}

Example: https://impl.workday.com/ccx/api/v1/mycompany

Authentication (Basic Auth): Username: n8n_integration_user Password: ********

Step 2: Create Workday Business process Events and Outbound Messaging

Configure Outbound Messaging Service: Search in Workday: Create Outbound Message

Message Type: Web Service Protocol: HTTP Method: POST Endpoint URL: Example: https://balkanid.app.n8n.cloud/webhook/<webhook-id> Format: JSON

Subscribe to Business Process Events: Search: Edit Business Process

Joiner Event: Hire Employee Trigger Stage: Business Process Completed

Mover Event: Change Job Trigger Stage: Business Process Completed

Leaver Event: Terminate Employee Trigger Stage: Business Process Completed

Configure Payload: Worker_ID Employee_ID First_Name Last_Name Email Manager Department Job_Profile Employment_Status

Example Webhook Payload:

{ "eventType": "worker.hired", "workerId": "123456", "firstName": "John", "lastName": "Doe", "email": "[e-mail]", "department": "Engineering", "jobTitle": "Software Engineer" }

Playbooks in Action

Joiner Playbook Flow

The Joiner playbook automates identity creation and access provisioning when a new employee joins the organization.

1. A new employee record is created in Workday

2. A Webhook or scheduled sync sends the event to BalkanID

3. The Joiner playbook is triggered

4. A user account is created in Okta on the employee’s start date

5. The playbook:

   • Applies preferred email formats

   • Detects and resolves name or email conflicts

6. Birthright access is determined using peer analysis based on attributes such as:

   • Job title

   • Department

   • Manager

   • Employment type

7. BalkanID generates access grant requests

8. Requests are:

   • Auto-approved via policies(see how to create policies here, or

   • Manually approved by designated approvers

9. Approved access is provisioned in Okta

10. Login credentials are securely shared with the employee’s manager

Leaver Playbook

The Leaver playbook ensures timely deprovisioning when an employee is terminated.

1. An employee is marked as terminated in Workday

2. The termination event is sent to BalkanID Leaver playbook and is triggered

3. BalkanID generates access revoke requests

4. Requests are:

Auto-approved through policy, or

Routed for manual approval

1. Upon approval, the user is suspended in Okta, preventing further access

Mover Playbook

The Mover playbook manages access changes when an employee’s attributes change.

1. An employee’s attributes (job title, department, manager, employment type, etc.) are updated in Workday

2. The change is detected and the Mover playbook is triggered

3. BalkanID recalculates the employee’s required access

4. Access grant and revoke requests are generated

5. Requests are:

Auto-approved using policies, or

Sent for manual approval

1. Approved changes are provisoned in Okta