Microsoft Dynamics 365 F&O and ADP integration

What moves between them

The main flow runs from ADP into Microsoft Dynamics 365 F&O. After each payroll run, ml-connector reads ADP general ledger documents and posts the labor cost journals into the D365 general ledger through the journal entities, mapped to the matching main accounts and financial dimensions. Worker records flow the same direction so D365 reference data reflects ADP hires, terminations, and rehires. Reference data such as cost centers, departments, and job codes is aligned so every payroll allocation lands on a valid D365 dimension. GL documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted, presents the ADP client certificate at the TLS layer on every request, and refreshes the ADP bearer token when a call returns 401. On the D365 side it requests an Entra ID client-credentials token scoped to each tenant operations.dynamics.com host, which it accepts as a credential field since there is no shared URL. ADP cost centers from the validation tables are mapped to D365 financial dimensions first, and each dimension is written as the formatted display string D365 expects, so every payroll journal line references a main account and dimension that already exist. Because ADP GL documents are output artifacts, ml-connector polls them on a schedule tied to your payroll calendar and can also receive ADP event notifications where enabled. ADP rate limits return HTTP 429 per gateway node and D365 returns 429 with a Retry-After header, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not become an outage. Posted journals carry a unique journal number so a replay does not double-post, and every record carries a full audit trail.

A real-world example

A mid-sized manufacturer with about 600 employees runs Microsoft Dynamics 365 F&O for finance, procurement, and supply chain across three legal entities, and uses ADP Workforce Now for payroll. Before the integration, the finance team exported payroll registers from ADP each pay period and re-keyed the labor totals into D365 by hand, then spent the first days of month-end close chasing differences between headcount and the labor accounts in the ledger. With the two systems connected, each pay run's ADP GL document posts into D365 automatically, allocated to the financial dimension for each plant and legal entity, and worker changes keep the reference data aligned. Close starts with the labor accounts already reconciled and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into the Microsoft Dynamics 365 F&O general ledger after every pay run, allocated to the correct main accounts and financial dimensions.
• •Keep D365 worker and vendor reference data aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes from the validation tables to D365 financial dimensions so payroll lands on valid accounts.
• •Authenticate ADP with OAuth2 and its required mutual TLS certificate, and D365 with Entra ID client credentials against each tenant operations.dynamics.com host.
• •Poll on a schedule tied to your payroll calendar, with retries on HTTP 429 and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 F&O and ADP?

The main flow is ADP into D365. Payroll GL documents and worker records move from ADP into Microsoft Dynamics 365 F&O, while cost centers and departments are aligned so allocations stay valid. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call to api.adp.com in addition to OAuth2 credentials, and the handshake fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.

How does the integration handle the D365 tenant-specific host and Business Events?

ml-connector accepts each environment's operations.dynamics.com host as a credential field, since D365 publishes no shared base URL, and requests an Entra ID client-credentials token scoped to that host. D365 Business Events are lightweight stubs that only carry identifiers, so the connector reads payroll GL data on a schedule and uses OData to fetch full records when needed.