We upgraded to WD R1 2023 last week and now our scheduled analytics reports are failing with permission errors. The strange part is that manual report execution works perfectly fine when users run them directly from the UI.
Our custom security group ‘Financial_Report_Automation’ was working flawlessly before the upgrade. We’ve already verified that security policies are correctly assigned and the security group sync completed successfully post-upgrade. The scheduled delivery job logs show “insufficient permissions” but don’t specify which permission is missing.
Has anyone encountered this after upgrading? Why would scheduled runs fail when manual execution succeeds?
We had this exact issue after our R1 2023 upgrade. Had to update both the integration system user AND the report delivery subscriptions. The manual execution works because it uses your user credentials which already have proper access through role assignments.
For scheduled reports failing but manual runs succeeding, you need to address three specific areas that changed in R1 2023:
Integration System User Permissions: Navigate to Setup > Integration System Users and locate the user running scheduled reports (typically ‘Workday System User’ or your custom ISU). Verify Financial_Report_Automation security group is explicitly assigned. R1 2023 no longer auto-inherits custom groups for system users.
Background Process Execution Rights: Your custom security group worked pre-upgrade for interactive reports but now needs batch execution rights. Go to Domain Security Policies > Integration System Security > Background Process Execution functional area. Add Financial_Report_Automation with Get and Put permissions. This is the key change - scheduled reports now require explicit batch execution authorization separate from report access.
Report Subscription Configuration: Check each failing scheduled report subscription. Edit the subscription and verify the ‘Run As’ field references either your integration system user OR ensure the subscription’s security context includes Financial_Report_Automation. Post-upgrade, some subscriptions revert to default security context.
Security Group Sync Validation: Even though sync completed, verify the effective permissions. Run a security audit report for your integration system user to confirm all three permission types are active: Report Writer domain access, Integration System Security batch execution, and custom group membership.
The security policies and group sync you already checked cover the authentication layer, but R1 2023’s stricter authorization model requires the explicit batch execution permission. This separation between interactive and automated execution is intentional - Workday enhanced security controls to prevent privilege escalation through scheduled processes.
After making these changes, test with a simple report first before enabling all scheduled deliveries. The permissions typically propagate within 15 minutes but can take up to an hour for complex security group hierarchies.
This draft is based on general Workday knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.
I’ve seen similar behavior after upgrades. The key difference is that scheduled reports run under the system service account context, while manual runs use your authenticated user context. Check if your custom security group has the ‘System’ domain security policy applied - this is often required for automated processes post-upgrade.
Also verify the Report Writer domain permissions. R1 2023 introduced stricter separation between interactive and batch report execution. Your custom group might need explicit ‘Execute Reports as Background Process’ permission in addition to standard report access. This wasn’t required in earlier versions.
Thanks both. I checked and our custom group does have System domain access. The ‘Execute Reports as Background Process’ permission is interesting - where exactly do I find this? Is it under Report Writer domain or Integration System Security?
Confirmed this resolves the issue — updating the Integration System User’s Financial Report Auto domain permissions in R1 2023 fixed our scheduled Analytics report delivery failures immediately.
It’s under Integration System Security domain. Navigate to Domain Security Policies > Integration System Security and look for ‘Background Process Execution’ functional area. Add your Financial_Report_Automation group there with Get and Put access. Also check if the scheduled delivery subscription itself references the correct security group - sometimes upgrade migrations don’t preserve custom group assignments on subscriptions.
One more thing - verify your integration system user configuration. R1 2023 changed how service accounts inherit permissions from security groups. The system might be trying to execute under a default integration user that doesn’t have your custom group membership. Check View Integration System User and confirm Financial_Report_Automation is in the security group assignments.