Stitchflow
ADP logo

ADP SCIM guide

Connector Only

How to automate ADP user provisioning, and what it actually costs

Summary and recommendation

ADP Workforce Now does not support inbound SCIM provisioning as a target application. Instead, ADP functions as an HR source system that provisions users TO other applications through third-party bridges like Aquera. This creates a fundamental misunderstanding in the market—while ADP integrates with identity providers like Okta and Azure AD, it's typically pushing employee data OUT to provision accounts in downstream systems, not receiving provisioning requests from your IdP. ADP supports SAML 2.0 and OIDC for SSO authentication, but user accounts must still be manually created and managed within ADP's HR platform.

This architectural reality creates significant operational overhead for IT teams. When new employees join or leave the company, their ADP records must be manually maintained by HR staff, while other applications can be automatically provisioned through your IdP. This breaks the unified identity lifecycle management that SCIM enables, forcing organizations to maintain split processes where some apps provision automatically while their core HR platform requires manual intervention.

The strategic alternative

ADP has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?No
SSO available?Yes
SSO protocolSAML 2.0, OAuth 2.0, OIDC
DocumentationNot available

Supported identity providers

IdPSSOSCIMNotes
OktaNo SCIM available
Microsoft Entra IDNo SCIM available
Google WorkspaceVia third-partyNo native support
OneLoginVia third-partyNo native support

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages ADP accounts manually. Here's what that costs:

Source: Stitchflow customers using ADP, normalized to 500 employees:
Orphaned accounts (ex-employees with access)52
Unused licenses0
IT hours spent on manual management/year136 hours
Unused license cost/year$0
IT labor cost/year$8,153
Cost of compliance misses/year$12,544
Total annual financial impact$20,697

The ADP pricing problem

ADP gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
RUN$79/month + $4/employee
Workforce Now$62/employee/month
Vantage HCMCustom pricing

Provisioning architecture

PlanPriceSSOSCIM
RUN$79/month + $4/employee
Workforce Now$62/employee/month
Vantage HCMCustom pricing

Implementation fees: $25-$200 per employee across all plans

What this means in practice

ADP Workforce Now is designed to be the authoritative HR source that pushes employee data TO other systems via SCIM—not receive provisioning from your IdP. This creates several operational challenges:

Reverse data flow
HR changes in ADP should trigger user provisioning in downstream apps, but your IdP can't provision users into ADP
Manual user creation
New ADP users must be created through HR processes, not IT provisioning workflows
Third-party dependency
Any SCIM connectivity requires Aquera Identity Directory Sync Bridge or similar solutions

Additional constraints

Aquera bridge requirement
SCIM functionality only available through third-party Aquera integration, adding complexity and cost
HR-driven workflow
User lifecycle events originate in ADP's HR system, not your identity provider's admin console
No inbound provisioning
Cannot disable/suspend ADP access through standard IdP deprovisioning workflows
Enterprise implementation costs
$25-$200 per employee setup fees make small deployments expensive relative to user count

Summary of challenges

  • ADP does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What ADP actually offers for identity

SAML SSO (Standard on all plans)

ADP Workforce Now supports federated single sign-on across all plan tiers:

SettingDetails
ProtocolSAML 2.0, OAuth 2.0, OIDC
Supported IdPsOkta, Azure AD, Google Workspace, OneLogin
JIT Provisioning✓ Yes
ConfigurationStandard SAML metadata exchange

SCIM Provisioning (Third-party bridge required)

ADP does not provide native SCIM endpoints for inbound provisioning. Instead, they offer outbound provisioning capabilities:

FeatureSupport Level
Inbound SCIM (IdP → ADP)❌ Not available
Outbound provisioning (ADP → IdP)✓ Via Aquera bridge
Direct SCIM API❌ No
Native user sync❌ No

The fundamental issue: ADP Workforce Now is designed as an HR source system that provisions to other applications, not as a target that receives provisioning from your IdP. This creates a backwards flow where HR events in ADP should trigger downstream provisioning to other apps.

Third-party Integration Requirements

To achieve any form of automated provisioning with ADP, you need:

Aquera Identity Directory Sync Bridge
Third-party connector that costs additional licensing
Enterprise-level ADP contract
Required for API access that Aquera depends on
Custom integration work
Most implementations require professional services

Bottom line: ADP's identity story is backwards from what most IT teams expect. You're not provisioning users into ADP from your IdP - you're using ADP as the authoritative source to provision out to other systems.

What IT admins are saying

Community sentiment on ADP's provisioning centers around role confusion and integration complexity:

  • ADP serves as the HR source system, not a typical SCIM target for provisioning
  • Third-party Aquera bridge required for any automated identity sync capabilities
  • Enterprise pricing tiers create barriers for mid-market organizations
  • Integration setup complexity when ADP needs to provision TO other systems

User accounts must exist in ADP to use single sign-on... ADP is typically the authoritative HR source that provisions TO other apps via Aquera.

ADP Integration Documentation

Complex integration requires Aquera - ADP as source not target creates confusion for IT teams expecting traditional SCIM provisioning.

IT Admin, Reddit

The recurring theme

ADP Workforce Now fundamentally operates as an HR source system that pushes data outbound, not as a target application that receives provisioning from your IdP. This architectural difference catches many IT teams off-guard who expect standard SCIM inbound provisioning.

The decision

Your SituationRecommendation
Using ADP as HR source to provision other systemsUse Stitchflow: streamline HR-driven provisioning workflows
Need to provision users TO ADP from your IdPUse Stitchflow: no native SCIM means manual user management otherwise
Small payroll team (<25 employees)Manual management acceptable, but consider automation for growth
Enterprise with complex HR workflowsUse Stitchflow: eliminate Aquera licensing and complexity
Multi-system environment with ADP as HR hubUse Stitchflow: centralize all provisioning through one platform

The bottom line

ADP Workforce Now operates as an HR source system rather than a typical SCIM target, requiring third-party bridges like Aquera for any automation. For organizations that need seamless provisioning TO ADP or want to eliminate complex middleware dependencies, Stitchflow provides direct automation without the enterprise complexity.

Make ADP workflows AI-native

ADP has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.

Covers apps without native SCIM, including the ones without APIs
Less than a week, start to finish (~2 hours of your time)
Built with your team; extend to anything else in the company
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

ADP is HR source system - not typical SCIM targetSCIM requires third-party Aquera bridgeNo native SCIM endpoint for inbound provisioning

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • ADP is HR source system - not typical SCIM target
  • SCIM requires third-party Aquera bridge
  • No native SCIM endpoint for inbound provisioning

Documentation not available.

Configuration for Okta

Integration type

Okta Integration Network (OIN) app

Where to enable

Okta Admin Console → Applications → ADP → Sign On

Enterprise required for SCIM

Use Stitchflow for automated provisioning.

Unlock SCIM for
ADP

ADP has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.

See how it works
Admin Console
Directory
Applications
ADP logo
ADP
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Builder.io logo

Builder.io

No SCIM

Visual CMS / Headless CMS

ProvisioningNot Supported
Manual Cost$11,754/yr

Builder.io, the visual CMS platform used by developers and content teams, does not offer SCIM provisioning on any plan. While Builder.io provides SAML 2.0 SSO integration on their Enterprise tier with identity providers like Okta, Azure AD, and Google Workspace, this only handles authentication—not the automated provisioning and deprovisioning of user accounts. IT teams must manually create and manage user accounts in Builder.io, then separately assign appropriate permissions for different Spaces and projects. This creates a significant operational gap for organizations using Builder.io across multiple content teams. Without SCIM, departing employees retain access to Builder.io Spaces until manually removed, creating security risks around content management systems that often contain sensitive marketing materials and website code. The manual overhead becomes particularly problematic when managing access across multiple Builder.io Spaces, each requiring individual permission management for developers, marketers, and content editors.

View full guide
Culture Amp logo

Culture Amp

No SCIM

Employee Engagement / People Analytics

ProvisioningNot Supported
Manual Cost$11,754/yr

Culture Amp, the employee engagement and people analytics platform, explicitly does not support SCIM provisioning on any plan. This is an intentional design decision - Culture Amp separates authentication (handled via SAML SSO) from employee data management (handled via HRIS integrations). While this approach works for their core HR use case, it creates a significant gap for IT teams managing user lifecycle across multiple SaaS applications through their identity provider. The lack of SCIM support means IT admins cannot automate user provisioning, deprovisioning, or attribute updates through standard identity governance workflows. Since Culture Amp contains sensitive employee feedback data and organizational hierarchy information that affects survey visibility, manual user management creates both security risks and operational overhead. Organizations are forced to rely on separate HRIS integrations or manual processes, breaking the unified provisioning model that most enterprises expect from their SaaS stack.

View full guide
Gladly logo

Gladly

No SCIM

Customer Service / Contact Center

ProvisioningNot Supported
Manual Cost$11,754/yr

Gladly, the customer service platform, does not support SCIM provisioning on any plan. While Gladly offers SAML 2.0 SSO integration with enterprise identity providers like Okta and Azure AD, this only handles authentication—users must still be manually created in Gladly's admin panel before they can sign in via SSO. Even on Enterprise plans with custom pricing, there's no automated user lifecycle management, meaning IT teams must manually provision and deprovision every customer service agent. This creates a significant operational burden for contact centers, where staff turnover rates are notoriously high and seasonal scaling is common. Without automated provisioning, IT teams face delays onboarding new agents during peak seasons, and security risks from lingering accounts when agents leave. The manual process becomes particularly problematic for organizations running large support teams or multiple contact centers, where dozens of agents may need to be onboarded weekly.

View full guide