Orchestrate ISU Error: MismatchedTenants When Promoting Between Environments
What it means
An Orchestration's credstore holds an OAuth refresh token that was generated against one specific tenant. Promoting the app to a different tenant, even a sibling IMPL sandbox, without regenerating that token for the new tenant causes the ISU to authenticate against the wrong tenant. Workday rejects the call at the token exchange step before the orchestration logic ever runs.
Troubleshooting
- Confirm the failure only appears after promoting to a new environment, and that the exact same app and config work in the source environment. That isolates the problem to environment-specific credentials, not app logic.
- Open the app's credstore configuration and check which refresh token is stored for the ISU calling the orchestration in the target tenant.
- Confirm whether that refresh token was actually generated against the target tenant or copied over from another tenant. Tokens are tenant-specific: a token generated for one IMPL sandbox will not work in a sibling IMPL sandbox.
- Check the orchestration ISU's Check Environment setting. Enabling it surfaces this mismatch as a generic Warning on credentials on the Create Values or Create JSON step rather than a clear message, which is why the root cause isn't obvious from the UI alone.
Generate a fresh refresh token directly against the target tenant and paste it into that tenant's credstore entry, then redeploy and retest.
Treat the credstore as a per-tenant artifact. Never copy a working refresh token between tenants, including sibling IMPL sandboxes, when promoting an app. Document a checklist step to regenerate and store a tenant-specific token as part of every promotion.