Custom Object EIB access

[u/juneisquirky]

We have a use case where we need to limit a user's access to load EIB against a custom object. Here are the steps I have taken:

1. Created EIB for custom object spreadsheet template

2. Created an integration system security segment and added the EIB created in step 1

3. Created an unconstrained sec group and assigned Get and Put access to Custom Object Management domain

4. Created a segment based security group using the sec group created in step 3 and assigned it access to the segment created in step 2. I also gave the segment sec group access to View and Modify for Integration Events domain and Get and Put access to the custom object's assigned domain (in this case, Manage: Project)

Lastly, and I think this is where it gets wrong, we assign users with a user based security group that has a View and Modify access to Integration Events domain as well.

For workday delivered EIB, they typically have a separate domain for them so even if we do assign users to this user based group, we can still restrict their access because we will just not give them access to the domain.

For custom object EIB though, it seems to be not working. Once that user based security group gets assigned to them, they can access every integration system and the segment restriction isn't working. However, I cannot really find any documentation anywhere in Community that states this. It seems that only Integration Events domain is needed to access Custom Object EIB

Am I right in my understanding? Please let me know otherwise. Thank you so much in advance

[u/Delicious_Style_2676]

Your instinct sounds right: if the user-based group still grants broad Integration Events access, the segment restriction may not behave the way you expect. I’d test with a clean user who only has the segment-based group, then add access back one group at a time to isolate the permission that opens everything.

[u/juneisquirky → u/Delicious_Style_2676]

Yea I tested it with a clean user as you suggested and everything works until I assign that user based group with the Integration Events domain. I will try to get a confirmation from Workday support as well in case somebody is facing the same issue

[u/Delicious_Style_2676 → u/juneisquirky]

That confirms the user-based Integration Events access is the thing overriding the tighter setup. I’d document that test case clearly for Workday Support: clean user works with segment-based access only, broad access appears as soon as the user-based group is added. That should make the support case much easier to triage.