Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2023-06-23
Example: Mobile PIN Authentication

Example: Mobile PIN Authentication

This example illustrates 1 way to configure an authentication policy that enables the use of a Personal Identification Number (PIN) on mobile devices.
Your organization uses a SAML Single Sign-On (SSO) solution. You want to enable workers to access Workday self-service tasks using a PIN to sign in on their mobile devices, however. You want to set the Mobile PIN with strict requirements:
  • PIN length from 6 to 8 digits.
  • Only 2 failed attempts before Workday resets the PIN.
  • PIN expires after 30 days.
You must have security administrator privileges.
  1. Access the
    Edit Tenant Setup - Security
     task.
  2. In the
    Mobile Authentication
     section, select the
    Enable Mobile PIN Authentication
     check box and enter these settings:
    Option Description
    PIN Min Length
    6
    PIN Max Length
    8
    PIN Max Failed Signin Attempts
    2
    Max Mobile Authentication Age (in days)
    30
  3. Access the
    Manage Authentication Policies
     report.
  4. Create a new authentication policy or edit an existing one.
  5. In the
    Authentication Ruleset
     grid, add this rule:
    Option Description
    Authentication Rule Name
    Worker Self-Service on Mobile Rule
    Security Group
    All Employees
    All Contingent Workers
    Authentication Condition
    Any
    Allowed Authentication Types
    Mobile PIN
    SAML
    Access Restriction for Authentication Condition
    Self-Service
     (See the next step to create.)
  6. If you haven't yet defined access restrictions, you can click the prompt for the appropriate rule under
    Access Restriction for Authentication Condition
     and select
    Create Access Restriction
    .
    For
    Worker Self-Service on Mobile Rule
    :
    Option Description
    Name
    Self-Service
    Allows Access to Security Groups
    Employee As Self
    Contingent Worker As Self
  7. In the
    Default Rule for All Users
    , check the
    Disabled
     check box.
  8. Click
    OK
     and
    Done
    .
  9. Access the
    Activate All Pending Authentication Policy Changes
     task to activate and confirm the changes.
  10. Notify your workers that they must sign in using their SAML SSO credentials before they set up their PIN.
    A worker needs to set up a new PIN to sign in with their SAML SSO credentials if Workday resets the PIN due to:
    • Too many failed sign-in attempts.
    • An expired PIN.
All workers can perform self-service tasks from their mobile devices, using their PIN to sign in.