---
category: [Administration & Integrations, Platform and Product Extensions, Platform and Product Extensions/Integration, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions/Workday Extend]
keyword: [Extend, ISU Authentication, Simplified ISU]
nav: wcp_docs
parent_url: /wcp_docs/
title: >- 
  Concept: ISU Authentication
layout: subsection
---

## <a id="section_8"></a>Overview

The simplified Integration System User (ISU) authentication uses a streamlined configuration and enhanced mechanism that enables apps to authenticate data access with an ISU account. This topic contains guidelines when using the simplified ISU authentication.

<b>Note:</b> The `WCPISU` authentication type is a legacy mechanism for authenticating apps with an ISU user. Instead of using `WCPISU`, Workday recommends the simplified `ISU` authentication type. Existing apps can continue using `WCPISU`, but new apps must use the simplified `ISU`. Note that in Orchestration Builder, the ISU credential uses the simplified ISU authentication. Workday strongly recommends that existing apps migrate to the simplified `ISU`.

In general:

-   The App Manager task in your tenant enables you to assign an ISU to your app and create an API client for that ISU. You can add multiple ISUs to an app, but an ISU can only be associated with a single app.
-   When using ISU authentication, you must take caution and add security checks in your app especially with restricted data.

    The ISU authentication scheme uses ISU access to enable end users to read and write data. Because the ISU access doesn't typically align with the tenant configurations for end users, you must consider additional security checks in your app. In general, we recommend using the security domains in your app to secure a page. However, if your app needs to use ISU authentication, you'll need to code business logic to check the roles and security groups of the current user. This check typically includes additional API calls to run a custom report about the user security details, which can affect page performance.

-   For Integration apps, Workday recommends using the access token for the initiating user. Generally, an ISU is assigned to the integration system in the tenant and this is why the access token for the initiating user is the recommendation. Use the ISU authentication with an Integration app only if the developer requires the integration to use a different ISU than the one used to launch the integration.


Example use cases:

-   A page can use an ISU to perform calculations on data from a restricted data source and display the calculation result to the app user. The app user only sees the calculated result but not the restricted data.
-   A long-running asynchronous orchestration can use an ISU instead of a user account whose access token expires sooner.


To configure the simplified ISU authentication, see [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html).

## <a id="section_3"></a>Security Permissions

The simplified ISU configuration requires these security permissions:

-   Security domain policies

    -   For creating ISUs: <i>Integration Security</i> domain in the Integration functional area.
    -   For assigning ISUs to an app in App Manager: <i>WCP Integration System User Security</i> domain in the System functional area.

        <b>Note:</b> The <i>WCP Integration System User Security</i> domain enables the Add Integration System User button in App Manager.


-   Developer Site permissions

    -   For adding consent for tenants to API clients: Company Administrator access.
    -   For deleting API client associated with deleted ISUs: Company Administrator access.



## <a id="section_5"></a>Creating New Apps with Presentation Components

When you create an Extend app with Presentation Components, you can no longer use the legacy WCPISU authentication in the SMD. Instead, use the simplified ISU authentication. Existing apps can continue to use the legacy WCPISU, but Workday recommends the simplified ISU authentication.

Extend apps created after October 4, 2024 must use the simplified ISU authentication. This includes Extend apps created from scratch and from a copy of an existing app. If the app already exists in App Hub and you’re reverting to old code or making updates, that won’t impact the creation date of the app itself.

## <a id="section_9"></a>Migrating Existing Apps that use Legacy WCPISU

To migrate existing apps that use the legacy WCPISU authentication to the simplified ISU authentication, follow the instructions in:

-   [Configure ISU Authentication in Presentation Components](/wcp_docs/GUID-f4c6727e-f363-4786-a90d-ecc30f062872.html)
-   [Create Orchestration Credentials](/wcp_docs/uwh1613475703138.html)


<b>Note:</b> You can’t configure the simplified ISU authentication with existing API clients used with the legacy WCPISU authentication.

## <a id="section_1"></a>Promoting Apps with ISU Authentication

Promoting an app that uses the simplified ISU authentication in a non-Development tenant requires:

-   The same ISU setup that assigns the ISU to the app and creates an API Client in <b></b>the non-Development tenant. For details, see [Steps: Set Up ISU Authentication for Apps](/wcp_docs/GUID-3277fec3-24c9-41da-9840-c61b41033f28-enHYPHENus.html) .
-   A list of authorized non-Development tenants for the API Client. This step requires a Company Administrator to add the consent in the <b>API Clients</b> page in the Developer Site. For details, see [Modify Authorized Non-Development Tenants for API Clients using ISU Authentication](/wcp_docs/GUID-a600ff24-400c-4621-8f23-1ec27a56fc61-enHYPHENus.html).


## <a id="section_4"></a>Tenant Refresh from Production

A tenant refresh copies all assets (including the ISU configuration) from Production (PROD) to Implementation (IMPL) and Sandbox (SBOX) tenants. After a refresh, the IMPL and SBOX tenants will be associated with the API Client for the PROD tenant. Therefore, you must add consent for each of the IMPL and SBOX tenants to the PROD API Client in the Console. Regardless of the tenant refresh process, your app continues to authenticate against the correct tenant. With the simplified ISU configuration, you no longer need to worry about IMPL/SBOX tenants using PROD credentials after a refresh.

For the legacy WCPISU authentication, a tenant refresh for existing apps using WCPISU will continue to work as those are already configured.

## <a id="section_7"></a>Removing API Clients

Take caution when you delete an API Client from the Developer Site, as it may affect the functionality of apps that use the API Client.

However, if the ISU association with an API Client has been removed due to any of these reasons, a Developer Site administrator can delete the API Client:

-   The ISU was removed from the app in App Manager.
-   The app that uses the ISU was deleted.


## <a id="section_6"></a>Avoiding ISU Authentication with Studio Integrations

The simplified ISU authentication is mainly for Extend apps. Studio integrations should utilize the [Client Credentials Grant Type](/wcp_docs/vle1524593542839.html). We encourage developers to avoid attempting to use the simplified ISU API Client. Instead, create a separate API Client for Studio integrations. For API client creation instructions, see [Create an API Client](/wcp_docs/zwx1518028675482.html).