Microsoft Dynamics 365 Business Central and Gusto integration

What moves between them

The main flow runs from Gusto into Microsoft Dynamics 365 Business Central. After each pay run completes, ml-connector reads the Gusto payroll and posts the labor cost as general journal lines into Business Central, with gross pay, employer taxes, and deductions allocated to the matching GL accounts and dimensions. Employee records flow the same direction so the Business Central employee list reflects Gusto hires, terminations, and rehires. Reference data such as GL accounts and dimension values is read from Business Central first and mapped to Gusto pay components, so every journal line lands on an account and dimension that already exists. Gusto general ledger postings are produced by ml-connector, not by Gusto, since Gusto has no GL concept of its own.

How ml-connector handles it

ml-connector stores both credential sets encrypted and runs two different login models. On the Gusto side it completes the authorization-code OAuth flow once per company, refreshes the two-hour access token, and rotates the single-use refresh token on every refresh so a stale token never breaks the connection. On the Business Central side it requests a client-credentials token from Microsoft Entra ID and builds the base URL from the environment name and company stored as credential fields. Gusto payroll webhooks arrive signed with HMAC-SHA256, so each event is verified against the subscription secret before anything posts, and the payroll uuid is used as the job key so a redelivered event does not double-post. Because Business Central GL accounts and dimensions are read-only, they are pulled and mapped first, and payroll dollar amounts are parsed as decimal strings rather than floats. Business Central general journals are written through the journals endpoint, and a check by document number guards against duplicate posts since the API has no idempotency-key header. Both sides return 429 when throttled, so ml-connector backs off and retries, and every record carries a full audit trail and can be replayed if a post fails.

A real-world example

A mid-sized professional services firm with about 120 staff runs Microsoft Dynamics 365 Business Central for finance and project accounting and uses Gusto for payroll and benefits. Before the integration, an accountant exported the payroll summary from Gusto after every semi-monthly run and hand-keyed the wage, tax, and benefit totals into Business Central as a journal, then split them across department dimensions by guessing from a spreadsheet. With the two systems connected, each processed Gusto payroll posts into Business Central automatically, allocated to the correct GL accounts and department dimensions, and employee changes keep the two systems aligned. Month-end close starts with labor already booked and the manual journal entry is gone.

What you can do

• •Post each processed Gusto payroll into Microsoft Dynamics 365 Business Central as general journal lines after every pay run.
• •Allocate gross pay, employer taxes, and deductions to the correct Business Central GL accounts and dimensions.
• •Keep the Business Central employee list aligned with Gusto hires, terminations, and rehires.
• •Bridge Gusto per-company OAuth and single-use refresh-token rotation with the Business Central Entra client-credentials token.
• •Verify Gusto payroll webhooks by HMAC-SHA256 and dedupe by payroll uuid, with retries and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 Business Central and Gusto?

The main flow is Gusto into Microsoft Dynamics 365 Business Central. Processed payroll totals post as general journal lines and employee records flow the same direction. Business Central GL accounts and dimensions are read-only over the API, so ml-connector maps to them but never writes a chart of accounts back into Gusto, which has no general ledger of its own.

How does Gusto payroll data become a general ledger entry in Business Central?

Gusto has no GL accounts or accounting dimensions, so ml-connector performs the mapping. It reads the gross pay, taxes, and deductions from each processed payroll, parses the string-decimal amounts safely, and writes them as lines on a Business Central general journal against the GL accounts and dimensions you configure. A check by document number prevents the same payroll from posting twice.

How are the two different login methods handled?

Gusto uses a three-legged OAuth authorization-code flow scoped to a single company, with a two-hour access token and a single-use refresh token that must rotate on every refresh. Business Central uses an unattended OAuth2 client-credentials token from a Microsoft Entra ID app. ml-connector stores both credential sets encrypted, runs each login model separately, and rotates the Gusto refresh token so the connection does not break.