Infor CloudSuite and ADP integration

What moves between them

The main flow runs from ADP into Infor CloudSuite. After each payroll run, ml-connector reads ADP's general ledger documents and posts the labor cost journals into the CloudSuite general ledger, mapped to the matching accounting dimensions and cost identities. Worker records move the same direction so CloudSuite headcount reflects ADP hires, terminations, and rehires. Reference data such as ADP cost centers, departments, and job codes is aligned with CloudSuite dimensions so payroll allocations land on valid accounts. GL documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, refreshing the ADP bearer token when a call returns 401. On the Infor side it accepts the full .ionapi file fields per customer, since each CloudSuite tenant has its own gateway URL and OAuth token endpoint, and it proactively refreshes the ION token before its 1 to 24 hour lifetime expires rather than reacting to a 401. Because CloudSuite has no self-service webhook, ml-connector polls ADP general ledger documents and worker data on a schedule tied to your payroll calendar, and can also receive ADP event notifications where they are enabled. Cost centers and departments are mapped first, so every payroll journal line references a CloudSuite dimension that already exists. M3 Add transactions are not idempotent, so ml-connector queries for an existing record before posting to avoid duplicate journals. ADP rate limits return HTTP 429 per gateway node, so it backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized industrial manufacturer with about 600 employees runs Infor CloudSuite M3 for production, procurement, and finance, and uses ADP Workforce Now for payroll across three plants. Before the integration, the finance team exported payroll registers from ADP every pay period and re-keyed the labor totals into CloudSuite by hand, then spent the first days of month-end close chasing differences between HR headcount and the labor accounts in the ledger. With Infor CloudSuite and ADP connected, each payroll run's GL document flows into CloudSuite automatically, allocated to the right accounting dimension per plant, and worker changes keep the two systems aligned. Month-end close starts with the labor accounts already reconciled, and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into Infor CloudSuite's general ledger after every pay run, allocated to the correct accounting dimensions.
• •Keep Infor CloudSuite headcount aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes to CloudSuite dimensions so payroll lands on valid accounts.
• •Authenticate ADP with OAuth2 and the required mutual TLS certificate, and CloudSuite with its tenant-specific ION OAuth2 token.
• •Poll on a schedule tied to your payroll calendar, with query-first dedup, retries, and a full audit trail on every record.

Questions

Which direction does data move between Infor CloudSuite and ADP?

The main flow is ADP into Infor CloudSuite. Payroll GL documents and worker records move from ADP into CloudSuite, while cost centers and departments are aligned with CloudSuite dimensions. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 client credentials. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.

How does the integration handle Infor CloudSuite's tenant-specific URL and lack of webhooks?

ml-connector accepts the full set of .ionapi fields per customer, since every CloudSuite tenant has its own ION gateway URL and OAuth token endpoint. Because CloudSuite offers no self-service webhook, it polls CloudSuite and ADP on a schedule tied to your payroll calendar rather than relying on a push.