Sage 100 and ADP integration

What moves between them

The main flow runs from ADP into Sage 100. After each payroll run, ml-connector reads ADP general ledger documents and posts the labor cost journals into the Sage 100 general ledger through the local agent, mapped to the matching segmented accounts and cost centers. Worker changes flow the same direction so Sage 100 vendor and headcount records reflect ADP hires, terminations, and rehires. Reference data such as cost centers, departments, and job codes is aligned so payroll allocations land on valid Sage 100 segments. GL documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted. On the ADP side it presents the client certificate at the TLS layer on every request and refreshes the bearer token when a call returns 401. On the Sage 100 side it calls the customer's local agent over HTTPS using the agent API key, since Sage 100 itself cannot be reached directly from the cloud and the agent enforces business rules through the Business Object Interface. Because Sage 100 has no webhooks, the connector polls ADP general ledger documents and worker data on a schedule tied to your payroll calendar, and it can receive ADP event notifications where they are enabled. Cost centers and departments are mapped first, so every journal line references a segmented account and division that already exist in Sage 100. Segmented account keys are parsed defensively because segment count varies by company, and AP records are matched on APDivisionNo plus VendorNo since Sage 100 has no idempotency key, so the connector checks for an existing record before it creates one. ADP rate limits return HTTP 429 per gateway node, so ml-connector backs off and retries, tracks the ADP certificate expiry so a renewal does not become an outage, and writes a full audit trail that can be replayed if an agent call fails.

A real-world example

A mid-sized contract manufacturer with about 200 employees runs Sage 100 for accounting on a server in its plant and uses ADP Workforce Now for payroll across two shifts. Before the integration, the controller exported the payroll register from ADP every pay period and re-keyed the labor totals into Sage 100 by hand, then spent the first days of month-end close reconciling headcount against the wage accounts in the ledger. With Sage 100 and ADP connected through the local agent, each payroll run's GL document posts into Sage 100 automatically, allocated to the cost center for each department, and worker changes keep the two systems aligned. Close starts with the labor accounts already reconciled and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into the Sage 100 general ledger after every pay run, allocated to the correct cost centers.
• •Keep Sage 100 vendor and headcount records aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes to Sage 100 segmented accounts so payroll lands on valid keys.
• •Authenticate ADP with OAuth2 and the required mutual TLS certificate, and Sage 100 through the local agent API key.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record, since Sage 100 cannot push events.

Questions

Which direction does data move between Sage 100 and ADP?

The main flow is ADP into Sage 100. Payroll GL documents and worker records move from ADP into Sage 100, while cost centers and departments are aligned so allocations land on valid accounts. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Why does Sage 100 need a local agent for this integration?

Sage 100 is on-premises and has no cloud API. Its SOAP surface only covers Sales Orders and Customers, so full GL and vendor access runs through the Business Object Interface, which must execute on the Sage 100 server. A local Windows agent wraps that interface and exposes an HTTPS endpoint that ml-connector calls with an agent API key, so payroll journals post with Sage 100 business rules applied.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 credentials, and the handshake fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.