Summary and recommendation
Ceridian Dayforce, the enterprise HCM platform, takes a unique approach to provisioning: it doesn't support native SCIM provisioning because it's designed to be the HR source of truth, not a provisioning target. Instead, Dayforce integrates with identity providers through SAML 2.0 SSO and relies on third-party connectors like Aquera for bidirectional provisioning workflows. While Okta's integration supports some basic provisioning functions, the real value comes from Dayforce pushing employee data (joiners/movers/leavers) to downstream systems rather than receiving provisioned users. This architecture works for their ~$245,000/year Enterprise customers who use Dayforce as their primary HR system, but creates complexity for IT teams who need seamless user lifecycle management.
The challenge emerges when organizations need to provision users into Dayforce from external systems or maintain consistent user states across multiple applications. SSO handles authentication, but manual user creation in Dayforce becomes a bottleneck for IT operations. The reliance on third-party connectors like Aquera adds another vendor relationship and potential failure point in your identity infrastructure.
The strategic alternative
Ceridian Dayforce has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | No SCIM available |
| Microsoft Entra ID | ✓ | ❌ | No SCIM available |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Ceridian Dayforce accounts manually. Here's what that costs:
The Ceridian Dayforce pricing problem
Ceridian Dayforce gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Enterprise | ~$245,000/year average | Via Aquera connector only |
Pricing and provisioning options
| Plan | Pricing | SCIM Provisioning | SSO |
|---|---|---|---|
| Enterprise | ~$245,000/year average | Via Aquera connector only | ✓ SAML 2.0 |
Key cost considerations
What this means in practice
You're locked into a third-party dependency: Dayforce's provisioning capabilities depend entirely on Aquera's connector technology. If Aquera experiences downtime, API changes, or support issues, your entire user provisioning workflow stops working.
Reverse provisioning complexity: Dayforce typically serves as the HR source of truth, meaning you often need to provision FROM Dayforce TO other applications rather than INTO Dayforce. This creates a complex bidirectional sync requirement that most IT teams aren't prepared to manage.
High barrier to entry: The ~$245,000 average annual cost puts automated provisioning out of reach for smaller organizations, forcing manual user management even for companies with hundreds of employees.
Additional constraints
Summary of challenges
- Ceridian Dayforce does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Ceridian Dayforce actually offers for identity
No Native SCIM Support
Dayforce does not provide native SCIM capabilities. Instead, they rely on third-party partnerships for automated provisioning:
| Feature | Status |
|---|---|
| Native SCIM API | ❌ Not available |
| Direct IdP provisioning | ❌ No |
| Third-party connector required | ✓ Yes (Aquera) |
| SAML SSO | ✓ Yes (requires support team) |
SAML SSO (Enterprise only)
Dayforce supports SAML 2.0 integration, but with significant setup complexity:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 |
| Configuration | Must involve Dayforce support team |
| SAML assertions | Must match specific format requirements |
| JIT provisioning | ✓ Supported |
| IdP/SP initiated | Both supported |
Critical limitation: You cannot configure SSO yourself. Every SAML setup requires coordination with Dayforce's support team and adherence to their specific assertion format requirements.
Provisioning via Aquera Connector
For automated provisioning, Dayforce partners with Aquera:
The reality: Most organizations use Dayforce as their HR source of truth, meaning you're more likely provisioning FROM Dayforce to other applications rather than INTO it. The Aquera connector addresses this workflow but adds complexity and cost to an already expensive enterprise platform.
At ~$245,000/year plus implementation fees (50-60% of first-year costs), you're paying premium enterprise pricing for identity features that require third-party solutions and support team involvement for basic configuration.
What IT admins are saying
Community sentiment on Ceridian Dayforce's provisioning setup reveals consistent friction around configuration complexity and support dependencies:
- SSO configuration requires opening tickets with Dayforce support team - no self-service setup
- SAML assertions must follow exact formatting requirements or authentication fails
- Native Azure AD HR provisioning doesn't include Dayforce (only Workday/SuccessFactors supported)
- Bidirectional provisioning requires third-party Aquera connector, adding complexity and cost
SSO setup requires Dayforce support team involvement
SAML assertions must be in specific format
Often serves as HR SOURCE rather than SCIM target
The recurring theme
Dayforce is typically the HR system of record that needs to provision out to other applications, not receive provisioning in from identity providers. This reverses the typical SCIM flow and requires specialized connectors like Aquera to handle the complexity.
The decision
| Your Situation | Recommendation |
|---|---|
| Small HR team (<50 employees) with simple needs | Manual user management is acceptable |
| Using Dayforce primarily as payroll/benefits only | Manual provisioning with SSO for authentication |
| Dayforce is your HR source of truth (100+ employees) | Use Stitchflow: automate provisioning FROM Dayforce to other apps |
| Enterprise needing bidirectional sync with AD/Entra | Use Stitchflow: avoid $50K+ Aquera partnership fees |
| Complex multi-app environment with compliance needs | Use Stitchflow: essential for audit trail and automation |
The bottom line
Dayforce is typically your HR source system, not a SCIM target—you need provisioning FROM Dayforce TO other applications. While Aquera partnerships exist for this, they cost enterprise-level fees and add complexity. Stitchflow provides the same bidirectional automation at a fraction of the cost, with support for any IdP and SOC 2 compliance built in.
Make Ceridian Dayforce workflows AI-native
Ceridian Dayforce has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- SSO setup requires Dayforce support team involvement
- SCIM assertions must be in specific format
- Often serves as HR SOURCE rather than SCIM target
- Requires third-party (Aquera) for full bidirectional provisioning
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Docs
Enterprise required for SCIM
Use Stitchflow for automated provisioning.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Enterprise required for SCIM
Use Stitchflow for automated provisioning.
Unlock SCIM for
Ceridian Dayforce
Ceridian Dayforce has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


