When creating an ISU, what should you do to ensure the user only authenticates via web services?

When creating an Integration System User (ISU), selecting the "Do Not Allow UI Sessions" checkbox is the explicit and mandatory step to prevent the account from being used to sign in to the Workday user interface. This configuration restricts the user's authentication capabilities exclusively to non-interactive channels, such as web service API calls. This is a critical security best practice for integration users, as it ensures the account is used only for its intended programmatic purpose and cannot be used for interactive sessions, thereby minimizing its attack surface.

A. Choosing a constrained security group limits the ISU's data access to specific business objects and contexts, but it does not control the method of authentication (UI vs. web services).
C. Updating the session timeout minutes controls how long an authenticated session remains active. It does not prevent the user from initiating a UI session in the first place.
D. Generating a random password is a security best practice for any account, but it does not technically prevent UI login. If an unauthorized party obtained the password, they could still attempt a UI login.

1. Workday Documentation, "Set Up the Integration System User": The official guide for the Create Integration System User task explicitly details the function of each field. It states that the Do Not Allow UI Sessions checkbox must be selected to ensure the user can only be used for integrations and cannot sign in to the Workday application. (Reference: Workday Community, Administrator Guide - Integrations, Section: Setting Up Integration Security).

2. Workday Documentation, "Security for Workday Web Services": This documentation outlines security best practices for integrations, emphasizing the principle of least privilege. It specifies that ISUs should be configured with "Do Not Allow UI Sessions" to limit their functionality strictly to API interactions, preventing potential misuse through the user interface. (Reference: Workday Community, Web Services Security Documentation, Section: Integration System Users).