QuickBooks Desktop and ADP integration

What moves between them

The main flow runs from ADP into QuickBooks Desktop. After each payroll run, ml-connector reads ADP general ledger documents and posts the labor cost journals into QuickBooks as journal entries, mapped to the matching QuickBooks accounts. Worker records flow the same direction so the QuickBooks employee list reflects ADP hires, terminations, and rehires. Reference data such as cost centers and departments is aligned so payroll lines map to accounts that already exist in QuickBooks. General ledger documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the ADP side it presents the client certificate at the TLS layer on every request and refreshes the bearer token when a call returns 401. On the QuickBooks side it runs a SOAP service that the QuickBooks Web Connector calls, validating the session ticket on each request and returning QBXML query and add messages. Because QuickBooks Desktop has no webhooks, both sides are pull driven: ml-connector polls ADP general ledger documents and worker data on a schedule tied to your payroll calendar, and the Web Connector polls on its own configured interval while QuickBooks is open. Cost centers and accounts are mapped first, so every payroll journal line references a QuickBooks account that already exists. ADP rate limits return HTTP 429 per gateway node, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Each journal entry posts with the QuickBooks transaction id stored as the external reference, so a repeated payroll document is not double posted. QuickBooks must be running with the company file open for the Web Connector to process a cycle.

A real-world example

A 200-person specialty contractor runs QuickBooks Desktop Enterprise for job costing and the general ledger, and uses ADP Workforce Now for payroll across several crews. Before the integration, the bookkeeper exported the payroll register from ADP every pay period and typed the labor totals into QuickBooks by hand, then reconciled headcount against the employee list at month end. With QuickBooks Desktop and ADP connected, each payroll run general ledger document posts into QuickBooks as a journal entry against the right accounts, and new hires and terminations update the employee list automatically. The manual re-keying step is gone and the labor accounts reconcile on their own.

What you can do

• •Post ADP payroll general ledger documents into QuickBooks Desktop as journal entries after every pay run.
• •Keep the QuickBooks employee list aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers and departments to QuickBooks accounts so payroll posts to valid accounts.
• •Bridge ADP OAuth2 and mutual TLS with the QuickBooks Web Connector SOAP session ticket.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between QuickBooks Desktop and ADP?

The main flow is ADP into QuickBooks Desktop. Payroll general ledger documents and worker records move from ADP into QuickBooks, while cost centers and departments are aligned so postings land on valid accounts. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

How does the integration connect to QuickBooks Desktop if it has no cloud API?

QuickBooks Desktop is reached through the QuickBooks Web Connector, a Windows agent that runs on the same machine as QuickBooks and polls a SOAP service. ml-connector runs that service, authenticates each cycle with a session ticket, and exchanges QBXML messages to read accounts and post journal entries. QuickBooks must be open with the company file loaded for a sync cycle to run.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 client credentials. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.