Microsoft Dynamics 365 Business Central and BambooHR integration

What moves between them

Data moves from BambooHR into Microsoft Dynamics 365 Business Central. ml-connector reads BambooHR employee records along with their department, division, location, and job title, and aligns the Business Central employees list with each change. Employment status drives hires, transfers, and terminations in the ERP, and department to dimension-value mappings keep org data landing on valid Business Central records. Because BambooHR has no finance documents, ml-connector does not move suppliers, invoices, or GL postings out of BambooHR; Business Central remains the source for all finance data. Reference data such as departments and dimension values is reconciled so the two systems agree, on a cadence tied to your HR change volume.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the BambooHR side it runs OAuth 2.0 authorization code against the customer subdomain, since the authorize and token URLs are subdomain-scoped rather than global, and it uses the offline_access refresh token to mint a new one-hour access token when a call returns 401. On the Business Central side it caches a Microsoft Entra client-credentials token and builds the base URL from the stored tenantId, clientId, clientSecret, and environmentName credentials, since the environment name is part of every path. BambooHR webhooks are verified with a timing-safe HMAC-SHA256 check over the raw body plus the X-BambooHR-Timestamp header before anything is trusted; because the payload is intentionally lightweight, ml-connector then calls GET /api/v1/employees/{id} to fetch the current values and writes them to Business Central employees by POST or PATCH. Where webhooks are not enabled it polls the cursor-paginated BambooHR employees endpoint instead, and on the Business Central side it can also register a subscription on the employees resource, answer the mandatory validationToken handshake, check the clientState shared secret, and renew before the three-day expiry. BambooHR departments are mapped to Business Central dimension values first, so every employee lands on an org dimension that already exists. BambooHR throttles with 503 and an optional Retry-After header while Business Central returns 429 when its per-minute limit is hit, so ml-connector backs off with jitter on both, and since neither side has an idempotency key it deduplicates on the BambooHR employee ID and the Business Central number business key. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized professional services firm with around 350 employees runs Microsoft Dynamics 365 Business Central for finance and project accounting and uses BambooHR as its HRIS across three offices. Before the integration, HR maintained departments, transfers, and terminations in BambooHR while a finance analyst re-keyed the same changes into Business Central so the employee list and department dimensions stayed current, and the two lists drifted apart between updates. With Business Central and BambooHR connected, employee and org changes flow into the ERP as they happen in BambooHR, mapped to the right dimension value per office. Headcount and dimensions stay aligned without manual re-entry, and project and expense allocations reference org data that matches HR.

What you can do

• •Sync BambooHR employees and their department, division, and job title into Microsoft Dynamics 365 Business Central as people are hired, moved, and terminated.
• •Map BambooHR departments to Business Central dimension values so org data lands on valid ERP records.
• •Verify BambooHR change webhooks with a timing-safe HMAC-SHA256 check, then fetch the current employee record from BambooHR.
• •Authenticate BambooHR with OAuth 2.0 on the company subdomain and a refresh token, and Business Central with Microsoft Entra client credentials.
• •Poll or react to events on a schedule you control, with backoff on BambooHR 503 and Business Central 429 throttling and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 Business Central and BambooHR?

Data moves from BambooHR into Business Central. Employee records, departments, job titles, and employment status flow from BambooHR so the Business Central employees list and dimension values stay current. BambooHR has no vendors, invoices, or GL accounts, so ml-connector does not pull finance data out of it; Business Central remains the source for all finance records.

Does the integration use BambooHR webhooks or polling?

It can use either. BambooHR pushes lightweight change events for employee created, updated, and deleted, which ml-connector verifies with a timing-safe HMAC-SHA256 signature check and then follows with a GET on the employee to read the current values. Where webhooks are not enabled, it polls the cursor-paginated BambooHR employees endpoint on a schedule you control, and it can also subscribe to the Business Central employees resource and renew before the three-day expiry.

How does ml-connector bridge BambooHR OAuth and Business Central Entra authentication?

BambooHR scopes both its base URL and its authorize and token URLs to each company subdomain, so ml-connector stores the subdomain as a credential and runs OAuth 2.0 authorization code against that instance, using the offline_access refresh token to mint a fresh one-hour access token. Business Central uses Microsoft Entra OAuth 2.0 client credentials, so ml-connector caches a service-to-service token from the stored tenantId, clientId, and clientSecret and builds the API URL from the environment name. Both credential sets are stored encrypted and refreshed when a call returns 401.