Sometimes, HR teams want Applaud to connect with systems that live inside their organisation’s own network, such as payroll databases or on-premise HR software. Workato’s On-premise Agent (OPA) makes this possible by creating a secure outbound connection from your network to Workato, without opening your firewall to the internet.
To read more about the OPA, see Workato’s article, On-premise Agent overview.
Why you might need OPA
- Payroll – share data securely between your on-premise payroll system and Applaud.
- HR databases – keep employee information in sync without manual updates.
- File servers – exchange documents, such as contracts or policies, stored internally.
OPA ensures these systems can integrate with Applaud while keeping your internal network protected.
System requirements at a glance
OPA can run on Windows, Linux, or macOS servers. Typical minimum requirements include:
- 8 GB RAM
- 250 MB disk space
- 800 MHz 64-bit CPU
For the most accurate and up-to-date requirements, see Workato’s article, Supported operating systems.
Who sets up OPA?
In most organisations, your IT team installs and maintains the OPA, while HR admins and Applaud configure the integrations that use it. This division of responsibility helps ensure both technical security and HR business needs are met.
When to plan for OPA
If you know you’ll need to integrate with on-premise systems, raise OPA requirements during your project planning stage. This gives IT time to prepare the environment in your development or user acceptance testing tenant before rolling out to production.
How OPA is managed
Applaud supports you in planning and configuring integrations that use OPA. However, OPA itself is a Workato component, and some details, such as installation steps, supported operating systems, and IP addresses that need to be safelisted, are documented and updated directly by Workato.
For the most accurate information, always check Workato’s documentation:
- On-premise Agent overview
- Supported operating systems
- On-prem Group
- OPA Versions
- Setting up On-prem Agent
- Workato IP allowlists
Applaud will help you understand whether OPA is needed in your scenario, and guide you through how it fits into your overall integration design. Workato’s documentation should be used as the definitive reference for setup details.
Important notes
- Outbound only: OPA never requires inbound firewall changes, only outbound traffic on port 443.
- IPs can change: If your IT team safelists IPs instead of hostnames, they must monitor Workato’s docs for updates. See Workato’s article, Workato IP allowlists. For customers accessing Workato in the EU data centre, see European Union data center.
- High availability: You can run multiple OPAs together in an On-prem group. This setup provides load balancing and resilience; if one OPA goes offline, another continues handling requests. For configuration details, see Workato’s article, On-prem Group.
- Downtime impact: If you only run a single OPA and it goes offline, integrations with on-premise systems will pause until the OPA is restored.
Best practice
- Test before production: Configure OPA in a development or UAT tenant first.
- Document your setup: Even though there’s no coding, integrations can become complex. Record which systems are connected through OPA for easier maintenance.
- Stay current: Check Workato’s documentation regularly for updates to requirements, supported systems, or IP ranges.