Sage 300 and ADP integration

What moves between them

The main flow runs from ADP into Sage 300. After each payroll run, ml-connector reads ADP's general ledger documents and posts the labor cost journals into Sage 300's general ledger, mapped to the matching Sage 300 GL accounts and cost centers. Worker records flow the same direction so Sage 300 headcount reflects ADP hires, terminations, and rehires. Cost centers and departments are aligned in both directions so payroll allocations land on valid Sage 300 cost center and account combinations. GL postings are read-only in ADP, so ml-connector never writes financial entries back to payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted: Sage 300 basic auth credentials are uppercase and included in the Authorization header, while ADP credentials consist of client_id, client_secret, mTLS certificate, and private key. On every ADP request, ml-connector presents the mutual TLS certificate and refreshes the OAuth2 bearer token when a call returns 401. On the Sage 300 side, ml-connector accepts the full IIS server URL and port per customer and uses OData filters with timestamps to poll for new general ledger documents and worker records on a schedule tied to your payroll calendar. Cost centers and job codes are mapped and validated first, so every payroll journal line references a Sage 300 GL account and cost center that already exists. ADP rate limits return HTTP 429 per gateway node, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized manufacturing company runs Sage 300 on-premise for production, procurement, and finance, and uses ADP for payroll across multiple plants. Before the integration, the finance team exported payroll registers from ADP every pay period and manually re-entered labor totals into Sage 300, then spent the first days of month-end reconciling differences between HR headcount and labor accounts in the general ledger. With Sage 300 and ADP connected, each payroll run's GL documents flow into Sage 300 automatically, allocated to the correct cost center for each plant, and worker changes keep the two systems aligned. Month-end close starts with the labor accounts already reconciled, and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into Sage 300's general ledger after every pay run, allocated to the correct cost centers.
• •Keep Sage 300 headcount aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers, departments, and job codes to Sage 300 GL accounts and cost center segments so payroll lands on valid accounts.
• •Authenticate ADP with OAuth2 and the required mutual TLS certificate, and Sage 300 with HTTP Basic Authentication.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between Sage 300 and ADP?

The main flow is ADP into Sage 300. Payroll GL documents and worker records move from ADP into Sage 300, while cost centers and departments are aligned in both directions. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 credentials. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.

Why does Sage 300 require polling instead of webhooks?

Sage 300 is an on-premise system with no webhooks or change-data-capture capability. ml-connector polls the Sage 300 API on a schedule using OData date filters to identify new records since the last sync, so your payroll data is always up to date without manual intervention.