A User-based security group is the most appropriate choice for this scenario. This type of group is designed to grant security permissions directly to a specific, manually assigned list of Workday users. It is an unconstrained group, meaning its members' access is not limited by their position within an organizational hierarchy. This is ideal for system administrators, auditors, or security oversight personnel who require broad access to run reports and perform tasks across the entire tenant, fulfilling the requirement to "run Security reports across all organizations."

A. Rule-based: This group dynamically assigns members based on worker attributes (e.g., job family, location), not a specific list of named individuals responsible for oversight.

B. Segment-based: This is a type of constrained group that secures access to specific segments of a worker population, which contradicts the need for unconstrained, tenant-wide access.

C. Role-based (Constrained): This group grants access based on an organizational role (e.g., Manager, HR Partner) and is inherently constrained by the organizations the role supports, which conflicts with the "across all organizations" requirement.

1. Workday Documentation

Security Administration Guide: "User-Based Security Groups." This section details that user-based groups are unconstrained and contain an explicit list of user accounts. They are recommended for administrator roles that require system-wide access

independent of organizational structure. (Reference: Workday Security Administration Guide

Chapter: "Security Group Types"

Section on User-Based Security Groups).

2. Cornell University

Division of Financial Affairs: "Workday Security Roles & Role Assignment Guide." This guide defines security group types. It specifies that User-Based Security Groups are "Manually assigned and maintained. Used for one-off security assignments" and are typically used for central administrative roles requiring broad access. (Reference: Page 4

"Types of Security Roles/Groups").

3. University of Washington

Integrated Service Center: "Workday Security 101." This training document explains that certain high-level administrative roles

such as Security Administrator

are assigned via User-Based Security Groups because their responsibilities are tenant-wide and not restricted to a specific supervisory organization. (Reference: Section on "Security Group Types").