Sage Intacct and ADP integration

What moves between them

The primary flow moves from ADP into Sage Intacct. After each payroll run, ml-connector reads ADP's general ledger documents and workers, then posts payroll GL entries into Sage Intacct's general ledger, mapped to the matching GL accounts and cost centers. Worker records flow in the same direction so Sage Intacct headcount reflects ADP hires, terminations, and rehires. Cost centers, departments, and job codes are aligned in both directions. Sage Intacct GL postings are never written back to ADP because ADP's general ledger documents are read-only output from payroll processing. The sync cadence is tied to your payroll calendar and runs on a schedule you control.

How ml-connector handles it

ml-connector presents the ADP mTLS client certificate at the TLS layer on every call and refreshes the OAuth bearer token when a call returns a 401 response. On the Sage Intacct side, it caches the session ID for up to 50 minutes and automatically requests a fresh one when the session expires, serializing all operations through the single XML gateway endpoint. Payroll GL entries from ADP are mapped first to existing cost centers and GL accounts in Sage Intacct, ensuring every journal line references valid dimensions before posting. Because both systems have rate limits, ml-connector backs off on HTTP 429 from either system and retries with exponential backoff. The ADP mTLS certificate's expiry date is tracked so renewal can be planned before it causes an outage. Sage Intacct's lack of webhooks means polling runs on your payroll schedule rather than waiting for a push. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-market professional services firm uses Sage Intacct for project accounting and labor cost tracking and ADP Workforce Now for payroll and HR across multiple offices. Before the integration, the accounting team manually exported labor cost reports from ADP each pay period and re-entered them into Sage Intacct's general ledger by hand, allocating costs to projects by office. Headcount reconciliation at month-end close was slow because hire and termination data had to be verified manually against two systems. With Sage Intacct and ADP connected, payroll GL entries flow into Sage Intacct automatically, allocated to the correct project cost center per office, and worker changes sync both directions, keeping the two systems aligned. Month-end close starts with labor accounts already reconciled, and the re-keying step is eliminated.

What you can do

• •Post ADP payroll general ledger documents into Sage Intacct's GL after each payroll run, allocated to the correct cost centers and projects.
• •Keep Sage Intacct headcount aligned with ADP worker hires, terminations, and rehires.
• •Map ADP cost centers and departments to Sage Intacct GL accounts and dimensions so payroll entries land on valid accounts.
• •Manage ADP OAuth tokens and present the required mutual TLS client certificate on every request, with automatic certificate expiry tracking.
• •Poll ADP and Sage Intacct on a payroll schedule, with retries and full audit trail on every record.

Questions

Which direction does data move between Sage Intacct and ADP?

The main flow is ADP into Sage Intacct. Payroll GL documents and worker records move from ADP into Sage Intacct, while cost centers and departments are aligned in both directions. ADP general ledger documents are read-only output from payroll processing, so ml-connector does not write financial entries back into ADP.

What makes ADP's mutual TLS requirement different from standard API authentication?

ADP requires a client certificate presented at the TLS handshake layer in addition to OAuth 2.0 credentials. The TLS handshake fails without the certificate, and the certificate must be kept current because it expires. ml-connector stores the certificate encrypted, presents it on every call, and monitors expiry to prevent outages when the certificate approaches renewal.

How does the integration handle Sage Intacct's single XML gateway and lack of webhooks?

ml-connector connects to Sage Intacct's single XML gateway endpoint at https://api.intacct.com/ia/xml/xmlgw.phtml, caches the session ID for 50 minutes, and automatically requests a fresh one when it expires. Because Sage Intacct has no webhooks, ml-connector polls for payroll GL and worker data on a schedule tied to your payroll calendar rather than waiting for a push.