Connecting an Extend app to the Workday Self-Service Agent and Microsoft Teams

What Workday actually connects

An Extend app reaches the Self-Service Agent's chat through a custom agent, not directly. Build a custom agent in the Extend app, deploy it, and activate it in Agent System of Record (ASOR), and Workday makes it available in the Self-Service Agent chat panel and in Sana. Microsoft Teams and Microsoft 365 Copilot are a separate channel: Workday Everywhere delivers the Self-Service Agent there, and Workday's documentation for that channel describes Self-Service Agent capabilities only. It doesn't say custom agents appear in Teams.

Three separate routes exist:

Put the Extend app in Workday Chat with a custom agent

Workday lists the places a custom agent can be invoked: the Self-Service Agent chat panel, Sana, the business process framework, A2A, and the Model Context Protocol. For an Extend app, the custom agent lives in the app itself and calls the app's business object operations and Custom Agent Action orchestrations as tools. Adding an agent to an Extend app you already have covers the design.

Two behaviours of the chat surface matter here:

• ASOR controls visibility. Before the agent is configured and activated in ASOR, it is hidden from end users. After activation, only members of the security groups selected in the agent's Available To field can use it. In Workday's tutorial, the user opens Agent Chat at the top right of the tenant and picks the agent from the dropdown at the top of the window.
• Workday Chat replaces Workday Assistant when the Self-Service Agent is on. When the Self-Service Agent is activated with at least one skill, Workday shows the Workday Chat bubble and hides the Workday Assistant bubble. If another agent is active but the Self-Service Agent isn't, users may see two chat icons.

If users need to hand the agent a document, add the agent_file_download tool to the skill file's tool-wids. Users then upload through the Sources button in Workday Chat.

Put the Self-Service Agent in Teams with Workday Everywhere

Workday Everywhere using the Self-Service Agent lets workers do self-service tasks from Gemini Enterprise, Microsoft 365 Copilot, Microsoft Teams and Slack. For Microsoft, Workday provides one Workday app that works in both Teams and Microsoft 365 Copilot, and users sign in once because the same token serves both.

Set up the tenant first:

1. Set up the Self-Service Agent and enable its skills.
2. On the Main Service Agreement (MSA), enable the Innovation Services feature and select the Workday Everywhere service in Innovation Services and Data Selection Opt-In; Universal Main Subscription Agreement (UMSA) tenants skip that. Then enable the Workday Everywhere functional area in Maintain Functional Areas.
3. Set up the Workday Everywhere Administrator domain, the Security Activation subdomain of Security Administration, and the WQL for Workday Extend subdomain of the Workday Extend domain.
4. Give the All Employees security group View and Get on View: Public Innovation Services Items and WQL for Workday Extend, and View and Modify on the Workday Everywhere User domain. Workday recommends granting that domain to Employee As Self and testing with selected groups before adding All Employees.
5. Run Activate Pending Security Policy Changes.

Then in Microsoft:

1. Install Workday as a third-party app in Teams and add it to a permission policy for your users, with the Microsoft Graph permissions Workday lists.
2. Enter the tenant alias (tenantname for Production, tenantname-sb for Sandbox) and sign in. The first sign-in needs Workday admin credentials.
3. On the app's Admin tab in Teams, click Configure for optional features.
4. For Microsoft 365 Copilot, install the same app there, send a greeting, click Connect to Workday, and sign in.

Workday's own verification step is to ask a question such as "What is my vacation balance?" It also notes that every worker needs a Microsoft 365 Copilot licence and Self-Service Agent access in Workday to avoid permission errors at sign-in.

The limits that shape what Teams users can do

What Teams users get is the Self-Service Agent, with its limits. Workday lists that it doesn't support additional jobs, implementer and proxy accounts, or delegated actions, and, as a general limitation, contingent workers; the Workday Everywhere page separately says contingent workers can use it once you grant them access, so check that in your tenant. A delegated action can look successful in the chat and still create no event in Workday. You can only connect a Production or Implementation instance of Teams or Microsoft 365 Copilot to the tenant, and Microsoft 365 Copilot doesn't receive Workday notifications.

Security follows the user: a manager sees their team's reviews, a worker sees only their own.

Reaching a custom agent from Microsoft's side

Workday documents two Microsoft-related agent features, and neither surfaces a Workday custom agent inside Teams:

• Microsoft Agent Sync runs the other way. It synchronises agents built in Microsoft Copilot Studio and Azure AI Foundry into ASOR, after a Microsoft Global Administrator grants admin consent to a service principal.
• A2A lets an outside platform call a custom agent on behalf of an authorized user, through a third-party agent definition in ASOR. Workday names Google Gemini Enterprise as the example platform; the setup is in connecting a custom agent to an outside platform with A2A. Workday documents the same route for calling the Self-Service Agent itself, using the ssa-agent-as-a-tool skill and resource ID 6bfadd7c014610000dffae8d77c00000.

If a client asks for "our Extend agent in Teams", that is not a documented configuration. What is documented is the Self-Service Agent in Teams, the custom agent in Workday Chat, and A2A to platforms that support it. Whether a Microsoft agent platform can consume a Workday custom agent over A2A is a question for that platform's own A2A support, and worth proving in a non-Production tenant before anyone promises it.

How to check each piece

• Custom agent in Workday Chat: sign in as a member of a group in the agent's Available To field, select the agent in the chat, send a request, then open the app's Agent Traces in App Builder and confirm the run and its tool calls.
• Self-Service Agent in Teams: the Workday Everywhere Admin page shows a green status when the agent is enabled and connected to the workspace. Then ask the verification question as an ordinary worker, not an admin.
• Who did what: View AI Agent User Audit Trail records agent actions with the agent as By User and the person as On Behalf Of User.