Using Fusion to bridge between Workfront and Active Directory

[JohnOS1]

Hi all!

I know someone must be doing this. But ultimately, I want to be able to have Workfront and AD talk with one another for user maintenance. Of course, you can bring in different pieces of data via SSO. However, I'm looking to create something more complex. (Automatically organize manager hierarchies, deactivation of users no longer with the company, bringing over user profile pictures, and more!)

What I'm wondering are the bits and pieces that I don't know that I don't know. What strategies worked when working with IT? I think the Fusion build will be a little complicated. I'm curious how others have handled the integration, along with any concerns IT/cybersecurity may bring up when building this out.

Any help = greatly appreciated!

[RachealRice]

Hi John, we're not using Active Directory, but we are using a Fusion integration with Workday to organize manager hierarchies, activation/deactivation, time off info, basic profile info like home group, home team, and role info. Resource availability was one of the problems we were trying to solve, which is why we opted for Workday-Workfront integration instead of AD-Workfront. If we weren't trying to incorporate time-off, we probably would have opted for AD.

In general, our HR and security teams got nervous about PII data and how it was being transferred from one system to the other and the potential exposure risk. Strategically we were clear about the business need for the info. For example, time zone affects due dates for our users while their mailing address doesn't give us anything actionable in WF so we don't include that. Demonstrating the efficiency gain for automatic setups was a game changer for onboarding too.

Our integration controls Home Group, Home Team, and Primary Role; and allows users to adjust Other Teams and Other Roles as we have people who slide in and out of different teams or roles with regularity so we let WF be where those changes happen.

Hope that helps even though it's not a direct AD connection!