Microsoft Dynamics 365 F&O and SAP Ariba integration

What moves between them

The main flow runs from SAP Ariba into Microsoft Dynamics 365 F&O. ml-connector submits Operational Reporting jobs for purchase orders, invoice headers, and suppliers, downloads the paginated results, and posts them into D365 F&O as PurchaseOrderHeadersV2 with lines, VendorInvoiceHeaders with lines, and VendorsV2, mapped to the matching accounts and dimensions. Vendor and financial dimension master data flows the other direction so D365 stays the source of truth and ml-connector can update supplier registration and qualification status in Ariba through the Supplier Data API. Posted general ledger entries stay read-only in D365 and are never written back to Ariba, since Ariba has no GL account API.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the D365 side it requests an Entra ID client-credentials token scoped to the environment host and refreshes it on the roughly one-hour expiry, and it accepts the full tenant environment URL per customer since D365 publishes no shared base address. On the Ariba side it sends the OAuth bearer token and the static apiKey header on every call and appends the realm query parameter, both of which are required or the call returns 401. Because Ariba is pull-only, it runs the reporting job pattern on a schedule, submitting a job filtered by updatedDateFrom and updatedDateTo, polling for completion, then paging the result by pageToken. Suppliers and accounting dimensions are mapped first, so every PO and invoice line resolves to a real D365 vendor and a valid financial dimension display string, which D365 requires to be configured in the integrating applications menu. D365 has no idempotency key, so ml-connector dedupes on the Ariba orderId or invoiceId plus a BullMQ jobId before posting against the D365 natural key, which avoids a duplicate-key error on a re-read document. Ariba reporting jobs are capped at a one-year filter window and tight submission rate limits, so backfill is split into annual chunks and the connector watches the X-RateLimit-Remaining-minute header to back off before a 429, while D365 OData 429s honor the Retry-After header. Vendor invoices are posted into D365 before posting, since the entity is read-only once posted, and high volumes can move through the async Data Management package API instead of row-by-row OData. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized manufacturer with roughly 800 employees runs Microsoft Dynamics 365 F&O for finance, procurement, and the general ledger, and rolls out SAP Ariba so category managers can run sourcing events and route purchase requisitions and supplier onboarding through the SAP Business Network. Before the integration, the procurement team exported Ariba reports each week and re-keyed approved purchase orders and supplier invoices into D365 by hand, which left orders sitting for days, introduced typing errors on cost centers, and let the vendor master drift apart between the two systems. With Microsoft Dynamics 365 F&O and SAP Ariba connected, each Ariba purchase order and invoice header flows into D365 within the polling window, allocated to the correct vendor and financial dimension, and supplier status updates flow back to Ariba. The re-keying step is gone and the AP and procurement ledgers reconcile against both systems.

What you can do

• •Post SAP Ariba purchase orders and invoice headers into Microsoft Dynamics 365 F&O as purchase orders and vendor invoice records.
• •Keep the D365 vendor master aligned with Ariba suppliers, and update supplier registration and qualification status back in Ariba.
• •Map Ariba PO and invoice line cost centers to D365 main accounts and financial dimensions so every line lands on valid coding.
• •Authenticate D365 with Microsoft Entra ID client credentials, and Ariba with its bearer token, apiKey header, and realm parameter.
• •Run Ariba reporting jobs on a schedule with annual-window backfill, rate-limit backoff, retries, and a full audit trail on every record.

Questions

Which direction does data move between Microsoft Dynamics 365 F&O and SAP Ariba?

The main flow is SAP Ariba into Microsoft Dynamics 365 F&O. Purchase orders, invoice headers, and suppliers move from Ariba into D365 as purchase orders, vendor invoice records, and vendors, while D365 vendor and dimension master data flows back so ml-connector can update supplier registration and qualification status in Ariba. Ariba has no GL account API, so posted ledger entries stay read-only in D365 and are never written back to Ariba.

Does SAP Ariba push purchase orders and invoices, or does ml-connector poll for them?

ml-connector polls. Ariba has no general-purpose outbound webhook, so bulk procurement data is extracted through the Operational Reporting API as async jobs that are submitted, polled, and downloaded by pageToken. ml-connector keeps a high-water mark on the updatedDateTo cursor and repeats on a schedule, splitting backfill into annual chunks because each reporting job is limited to a one-year filter window.

How does the integration bridge the two different authentication models?

On the Dynamics 365 F&O side, ml-connector requests an OAuth 2.0 client-credentials token from Microsoft Entra ID scoped to the tenant environment host and refreshes it before its roughly one-hour expiry. On the SAP Ariba side, every call carries both an OAuth bearer token and a static apiKey header, plus the customer realm as a query parameter, and missing either credential returns 401. ml-connector stores both credential sets encrypted and presents the right one to each system on every request.