Sage Intacct and SAP SuccessFactors integration

What moves between them

Employee and cost center records flow from SAP SuccessFactors into Sage Intacct. When a new hire is added to SuccessFactors or a termination is processed, ml-connector pulls those changes via OData query filtering on lastModifiedDateTime and posts the dimensions and GL account mappings into Intacct. Cost centers and departments are aligned in both directions so payroll posting always references valid GL accounts and cost center codes. SuccessFactors employee data is the authority; Intacct dimensions are updated to match, never the reverse.

How ml-connector handles it

ml-connector manages OAuth 2.0 SAML Bearer token generation and refresh for SuccessFactors, signing the SAML assertion with the customer's private key and obtaining 24-hour tokens that are refreshed before expiry. On the Intacct side, it handles session-based authentication with the initial getAPISession call, caches the sessionid for the full 50-minute window, and refreshes on expiry. It polls SuccessFactors using OData filters on lastModifiedDateTime to retrieve only changed employees and cost centers, respects the OData page size limit of 1000 records per request, and handles HTTP 429 throttle responses by backing off and retrying. All data destined for Intacct is serialized into XML, with forbidden XML control characters stripped before entity reference escaping. Each record carries the uniqueid flag for server-side deduplication on retried operations. Cost center and employee mappings are validated against the Intacct dimension hierarchy before posting, so a GL account mismatch fails gracefully with a full audit trail rather than posting to a wrong account.

A real-world example

A mid-sized professional services firm runs Sage Intacct for general accounting and project cost tracking, and uses SAP SuccessFactors for HR and compensation management across three regional offices. Before the integration, the finance team manually exported employee lists and cost center assignments from SuccessFactors each month and re-entered them into Intacct's dimensions so payroll allocations would land on the correct GL accounts and cost center codes. New hires were missed in the GL for weeks until someone noticed, and terminated employees lingered in the GL until a separate cleanup run. With SuccessFactors and Intacct connected, every hire and termination automatically flows into Intacct dimensions, cost center changes in HR are reflected in the GL within polling intervals, and month-end close begins with headcount and cost structure already reconciled. The manual export-and-re-enter step is eliminated.

What you can do

• •Sync SuccessFactors employees, jobs, and cost centers into Sage Intacct GL dimensions and account mappings.
• •Authenticate SAP SuccessFactors with OAuth 2.0 SAML Bearer assertion and Sage Intacct with session-based auth, managing token refresh and session expiry.
• •Pull employee and cost center changes from SuccessFactors using OData delta sync with lastModifiedDateTime filters, respecting page size limits and throttle responses.
• •Serialize all records into Intacct's XML format, stripping forbidden control characters and validating GL account and cost center references before posting.
• •Maintain a full audit trail on every employee and cost center record, with deduplication on retry via the Intacct uniqueid flag.

Questions

Which direction does data move between SuccessFactors and Intacct?

Employee and cost center records flow from SAP SuccessFactors into Sage Intacct. ml-connector polls SuccessFactors for hires, terminations, and cost center changes, then posts those dimension updates into Intacct so payroll allocations land on valid GL accounts. Cost centers are the authority in SuccessFactors; Intacct dimensions are updated to match. Financial records, GL accounts, and AP data never move back to SuccessFactors.

How does the integration handle SuccessFactors' OAuth token and Intacct's session-based auth?

ml-connector generates SAML assertions signed with the customer's RSA private key and exchanges them for SuccessFactors' 24-hour Bearer tokens, managing refresh before expiry. On the Intacct side, it exchanges senderId, senderPassword, companyId, userId, and userPassword for a sessionid via the getAPISession call, caches that session for the full 50-minute lifetime, and refreshes on expiry. Both auth flows are handled transparently; retries use the same cached session or token until expiry.

What happens if an employee or cost center in SuccessFactors does not map to a valid Intacct GL account?

Before posting any dimension or cost center update, ml-connector validates the GL account and cost center references against the Intacct hierarchy. If a reference is invalid, the record fails validation with a detailed audit entry explaining the mismatch, and no partial or wrong-account posting occurs. The customer can correct the mapping in SuccessFactors or Intacct and retry without manual re-keying.