Microsoft Dynamics 365 Business Central and Deel integration

What moves between them

The main flow runs from Deel into Microsoft Dynamics 365 Business Central. ml-connector reads Deel billing invoices, Deel-fee invoices, and contractor worker invoices and posts them into Business Central as purchase invoices, or as payment journal lines against vendor ledger entries, each coded to the matching GL account and dimension. Worker records flow the same direction so Business Central employees reflect Deel hires, profile updates, and terminations. Cost center allocations carried on Deel contracts are aligned to Business Central dimensions so each line lands on a valid account. GL accounts are read-only in the Business Central API and Deel has no standalone GL resource, so ml-connector reads ledger references from Deel payloads and never writes chart-of-accounts entries back into Deel.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the Deel side it sends the organization bearer token, or requests and refreshes an OAuth2 token before its 30-day expiry and adds the required x-client-id header, and it pages results with limit and offset or a cursor. On the Business Central side it requests an Entra ID client-credentials token for the customer's tenant and environment name and builds every path under the right company. Deel pushes worker and contract events signed with HMAC-SHA256, so each webhook is verified against the raw request body before processing, and worker lifecycle events update Business Central employees. For invoices and payments ml-connector polls Deel on a schedule, because billing and payroll data settle on Deel's own calendar. GL accounts and dimensions are mapped first, so every posted line references a Business Central account and dimension that already exists, and Deel cost centers obtained by expanding the contract are translated to those dimensions. Deel accepts an Idempotency-Key on writes, and ml-connector derives a stable BullMQ jobId from the Deel invoice id so a re-read does not double-post into Business Central. Business Central webhook subscriptions expire after 3 days, so a scheduled renewal keeps the employee subscription alive, and because the notification carries no data the changed worker is fetched after each signal. Deel returns HTTP 429 with a Retry-After header and Business Central throttles at its per-environment limit, so ml-connector backs off and retries, and every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A software company of around 400 people runs Microsoft Dynamics 365 Business Central for finance and uses Deel to employ engineers and contractors across a dozen countries through employer-of-record and contractor agreements. Before the integration, an accountant downloaded each Deel billing invoice and contractor payment every cycle and keyed the amounts into Business Central by hand, while HR separately added and removed people in both systems, which left the employee list and the labor accounts drifting apart and slowed month-end close. With Microsoft Dynamics 365 Business Central and Deel connected, each Deel invoice posts into Business Central coded to the correct account and dimension, and worker changes flow through so the two systems stay aligned. The re-keying step is gone and close starts with the labor costs already booked.

What you can do

• •Post Deel billing, Deel-fee, and contractor worker invoices into Microsoft Dynamics 365 Business Central as purchase invoices or payment journal lines.
• •Keep Business Central employees aligned with Deel hires, profile updates, and terminations.
• •Map Deel cost center allocations to Business Central dimensions so each posted line lands on a valid account.
• •Bridge Deel's bearer or OAuth2 token and the Business Central Microsoft Entra ID service-to-service login.
• •Verify Deel HMAC-SHA256 webhooks and renew the 3-day Business Central subscriptions, with retries and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 Business Central and Deel?

The main flow is Deel into Business Central. Billing invoices, contractor invoices, and worker records move from Deel into Business Central as purchase invoices, journal lines, and employees, while cost center allocations are mapped to Business Central dimensions. GL accounts are read-only in the Business Central API and Deel has no standalone GL resource, so the chart of accounts stays in Business Central and ml-connector does not write ledger accounts back into Deel.

Does Deel push worker changes, or does ml-connector poll for them?

Both. Deel pushes signed events such as hris.employee.created, hris.employee.updated, and hris.employee.terminated, which ml-connector verifies by HMAC-SHA256 against the raw request body and applies to Business Central employees. Invoices and payroll data are read by polling on a schedule because they settle on Deel's own billing calendar.

How does the integration bridge the two authentication methods?

ml-connector stores both credential sets encrypted. For Deel it sends a long-lived organization bearer token, or refreshes an OAuth2 token before its 30-day expiry and adds the required x-client-id header. For Business Central it requests an OAuth 2.0 client-credentials token from Microsoft Entra ID scoped to the customer's tenant and environment name, then builds every request under the correct company.