Workday: HR system of record, source of truth on which accounts should be provisioned and deprovisioned in AD.

Active Directory: holds those accounts.

Okta/OneLogin: facilitates use of AD accounts to log in to webapps.