SAP ECC and ADP integration

What moves between them

The main flow moves payroll GL documents from ADP into SAP ECC. After each payroll run, ml-connector reads ADP's general ledger documents, maps the labor cost journals to the matching SAP ECC GL accounts and cost centers, and posts them using BAPI_ACC_DOCUMENT_POST. Worker records flow the same direction so SAP ECC headcount reflects ADP hires, terminations, and rehires. Cost centers, departments, and GL accounts are read from SAP ECC first to validate that every payroll allocation lands on accounts and dimensions that exist. Payroll GL documents are read-only in ADP, so ml-connector never writes financial entries back to payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted. For ADP it presents the client certificate at the TLS layer on every call and refreshes the OAuth2 bearer token when a call returns 401 Unauthorized. For SAP ECC it uses HTTP Basic Auth for OData queries or RFC Basic Auth through the customer-deployed .NET Connector agent. ml-connector polls SAP ECC cost centers and GL account master data on the first run or on demand to build a mapping table, so every payroll journal line references valid dimensions. Because SAP ECC has no outbound webhook system, it polls ADP on a schedule tied to your payroll calendar. ADP rate limits return HTTP 429 per node in its cluster, so ml-connector backs off and retries with exponential jitter. ADP client certificates expire, so ml-connector tracks certificate expiry to alert before renewal is required. Every record carries a full audit trail and can be replayed if a downstream BAPI call fails.

A real-world example

A mid-sized discrete manufacturer runs SAP ECC on-premises for accounting and supply chain, and uses ADP Workforce Now for payroll across multiple plants and a head office. Before the integration, the accounting team exported payroll registers from ADP after each pay period and re-entered labor costs into SAP ECC by hand, allocating each entry to the correct cost center and GL account. Month-end close required extra days to reconcile SAP ECC headcount with ADP headcount and chase differences between payroll registers and GL postings. With SAP ECC and ADP connected, each payroll run's general ledger documents flow into SAP ECC automatically, pre-allocated to the cost center for each plant, and worker changes keep the two systems aligned. Month-end close now starts with the labor accounts already reconciled and the manual re-keying step is gone.

What you can do

• •Post ADP payroll GL documents into SAP ECC's general ledger after every pay run, allocated to the correct cost centers and GL accounts.
• •Keep SAP ECC headcount aligned with ADP hires, terminations, and rehires so your employee master stays in sync.
• •Map ADP cost centers and departments to SAP ECC GL dimensions so every payroll allocation lands on valid accounts.
• •Handle ADP mutual TLS certificate authentication on every call and SAP ECC RFC/BAPI authentication through your on-premises agent.
• •Poll on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between SAP ECC and ADP?

The main flow is ADP into SAP ECC. Payroll GL documents and worker records move from ADP into SAP ECC, while cost centers and GL accounts are read from SAP ECC first to validate that allocations are correct. ADP general ledger documents are read-only, so ml-connector never writes financial entries back into ADP.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 credentials. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal can be obtained before the certificate becomes invalid and causes an outage.

How does SAP ECC polling work if SAP ECC has no webhooks?

ml-connector polls SAP ECC cost centers and GL accounts on the first run to build a master mapping, and then polls ADP on a schedule you control, typically tied to your payroll calendar. The ADP polling can also be triggered by ADP event webhooks if you have them enabled, which will initiate a sync after worker or pay data changes occur.