HR, payroll and benefits · US and Canada

ADP Lyric HCM as the source for Okta, from the first day.

StitchOps uses ADP Lyric HCM as the source for Okta. New hires are in Okta before day one, role and manager changes update their access, and leavers are removed on their last day, with no HRIS API fee or custom development.

Book a free workflow audit Get a demo

HR Source pricing →

What's hard about ADP Lyric HCM today.

Lyric is ADP's newer global HCM platform, so many companies are moving to it from another ADP system. During and after that move, Okta often keeps reading from the old system or from spreadsheets, and the HR changes that matter most for access never reach it on time.

What StitchOps does in ADP Lyric HCM.

Joiners in Okta before day one

When HR adds a new hire in ADP Lyric HCM, StitchOps creates them in Okta before their start date, so Okta can give them the apps their role needs on day one.

Role changes that update access

When ADP Lyric HCM shows a new job, department, manager or location, StitchOps updates the person in Okta, and Okta adds and removes app access to match.

Leavers removed on their last day

When a last day arrives in ADP Lyric HCM, StitchOps deactivates the person in Okta, and Okta removes their access in every app it manages.

Ready when you move to Lyric

If you are moving to Lyric from another ADP system, StitchOps can switch its source when you go live, so Okta keeps getting joiners and leavers through the move.

Email and username written back

Once Okta has the new person's email and username, StitchOps writes them back to their record in ADP Lyric HCM, so HR and IT see the same details.

No API fee, no custom development

StitchOps does not need a paid ADP Lyric HCM API, a SCIM upgrade or a custom integration. It reads changes the way your HR team sees them, or uses a connection you already have.

Before and after.

The manual wayWith StitchOps

New hire added in ADP Lyric HCMIT waits for an email, then builds the account.In Okta before day one, with the apps the role needs.

Move to Lyric from another ADP systemOkta reads the old system until someone rebuilds the feed.Source switched at go live, nothing missed.

Last dayAccess removed when someone remembers.Deactivated in Okta, every Okta app follows.

Role or manager changeNew access by ticket, old access forgotten.Okta updated, access matches the new role.

What Okta covers for ADP Lyric HCM, and what StitchOps adds.

Okta signs users in and manages accounts where the app supports it in the Okta Integration Network. StitchOps covers the rest of the ADP Lyric HCM account lifecycle.

Not in the Okta Integration Network.

StitchOps covers 8 of 8 capabilities for ADP Lyric HCM.

What Okta covers for ADP Lyric HCM, and what StitchOps adds
Capability	Okta, from the OIN	StitchOps
Single sign on	No SAML or OIDC in the OIN.	Enterprise password management signs users in to ADP Lyric HCM with vaulted credentials. Users never need the password.
Shared accounts and MFA	Not part of the OIN listing.	Shares ADP Lyric HCM logins and their MFA across a team, with credentials kept in your vault.
Joiners	No account creation in the OIN.	Creates the ADP Lyric HCM account with the right role on day one, anywhere a person can log in and act.
Movers	No account updates in the OIN.	Changes ADP Lyric HCM roles and access when someone changes jobs, anywhere a person can log in and act.
Leavers	No deprovisioning in the OIN.	Removes ADP Lyric HCM access the day someone leaves, anywhere a person can log in and act, and saves evidence of the removal.
Password rotation	No password rotation in ADP Lyric HCM.	Changes the ADP Lyric HCM password on a schedule and the day someone leaves, and updates your vault in the same run.
Access reviews	No connector to read or remove ADP Lyric HCM accounts.	Pulls the ADP Lyric HCM user list on a schedule, compares it to your directory, and removes what you approve.
Audit evidence	Nothing logged inside ADP Lyric HCM.	Step level evidence for every action StitchOps takes in ADP Lyric HCM.

Single sign on
Okta, from the OIN
No SAML or OIDC in the OIN.
StitchOps
Enterprise password management signs users in to ADP Lyric HCM with vaulted credentials. Users never need the password.
Shared accounts and MFA
Okta, from the OIN
Not part of the OIN listing.
StitchOps
Shares ADP Lyric HCM logins and their MFA across a team, with credentials kept in your vault.
Joiners
Okta, from the OIN
No account creation in the OIN.
StitchOps
Creates the ADP Lyric HCM account with the right role on day one, anywhere a person can log in and act.
Movers
Okta, from the OIN
No account updates in the OIN.
StitchOps
Changes ADP Lyric HCM roles and access when someone changes jobs, anywhere a person can log in and act.
Leavers
Okta, from the OIN
No deprovisioning in the OIN.
StitchOps
Removes ADP Lyric HCM access the day someone leaves, anywhere a person can log in and act, and saves evidence of the removal.
Password rotation
Okta, from the OIN
No password rotation in ADP Lyric HCM.
StitchOps
Changes the ADP Lyric HCM password on a schedule and the day someone leaves, and updates your vault in the same run.
Access reviews
Okta, from the OIN
No connector to read or remove ADP Lyric HCM accounts.
StitchOps
Pulls the ADP Lyric HCM user list on a schedule, compares it to your directory, and removes what you approve.
Audit evidence
Okta, from the OIN
Nothing logged inside ADP Lyric HCM.
StitchOps
Step level evidence for every action StitchOps takes in ADP Lyric HCM.

Okta coverage from the Okta Integration Network, read October 24, 2026. ADP Lyric HCM has no OIN listing. StitchOps for Okta →

Common questions.

Do we need a ADP Lyric HCM API or SCIM connection?

No. StitchOps reads hires, changes and terminations from ADP Lyric HCM the way your HR team sees them. If your team already has a connection in place, StitchOps can use it instead.

We are still moving to ADP Lyric. Can we start now?

Yes. StitchOps can use your current ADP system as the source today and switch to Lyric when you go live, so Okta keeps getting hires and terminations the whole way through.

What login does StitchOps need in ADP Lyric HCM?

A login that can see hires, job changes and terminations, kept in your vault (1Password or Keeper) or the StitchOps vault. StitchOps runs on a dedicated worker VM in your environment, and models never see the credentials.

How is HR Source priced?

HR Source is priced per HR system per year, by company size, with no ADP Lyric HCM API or SCIM fee on top. Prices are on our pricing page, and Connect for each app is priced separately.

How long does it take to connect ADP Lyric HCM?

If StitchOps can log in to ADP Lyric HCM, it can often be connected in a day. A 30 day pilot can prove it in your own Okta before you sign.

Is ADP Lyric HCM in the Okta Integration Network?

No. As of October 24, 2026, the OIN has no listing for ADP Lyric HCM. Okta can sign users in only through a custom app if ADP Lyric HCM supports SAML or OIDC, and has no connector to manage ADP Lyric HCM accounts.

Can Okta deprovision ADP Lyric HCM users?

Not through an OIN connector. StitchOps removes ADP Lyric HCM accounts the day someone leaves, anywhere a person can log in and act, and saves evidence of each removal.

How do you rotate ADP Lyric HCM passwords when someone leaves?

StitchOps logs in to ADP Lyric HCM, sets a new password, confirms it took effect, and updates 1Password, Keeper or the StitchOps vault in the same run.

For your IT team

Where it runs: An agent runs an unattended desktop session on a dedicated worker VM in your environment, on Windows or macOS. It connects outbound only over TLS 1.2 or later. No inbound ports are opened.
Credentials: Credentials stay in your vault (1Password or Keeper) or in the StitchOps vault, encrypted with AWS KMS and resolved on the worker at run time. Models never see the values.
Okta stays the source of truth: StitchOps creates, updates and deactivates people in Okta from your HR system, and Okta Lifecycle Management carries the change to every app. StitchOps is listed in the Okta Integration Network.
Logs and telemetry: Every run keeps step level logs with status, timing and redacted results. Telemetry is content free: no field values, no personal data, no screenshots.
Security reviews: SOC 2 Type 2 examination completed, with HIPAA and GDPR Article 5 attestations, by Sensiba LLP. Penetration tested by a third party. ISO 27001 certification being finalized. The security packet is shared under NDA.

Last updated October 24, 2026. Product names are trademarks of their respective owners. StitchOps is not affiliated with or endorsed by them.

See it run in your ADP Lyric HCM.

Fifteen minutes on how ADP Lyric HCM reaches Okta today. We show you joiners, movers and leavers running from it.