SAP ECC and Dayforce integration

What moves between them

The main flow runs from Dayforce into SAP ECC. After each payroll run, ml-connector reads Dayforce employee records and org unit changes using OAuth2 credentials, maps job codes and org units to SAP ECC cost center dimensions, and syncs employee headcount into SAP ECC via BAPI_EMPLOYEE_GETDATA and cost center updates. Next, ml-connector reads the payroll GL posting data from Dayforce reports and posts labor cost journals into SAP ECC general ledger via BAPI_ACC_DOCUMENT_POST, using the REF_DOC_NO field as an idempotency key to prevent duplicate postings on retry. The flow is read-only on the Dayforce side; ml-connector does not write back to Dayforce.

How ml-connector handles it

ml-connector stores SAP ECC on-premises agent credentials and Dayforce OAuth client credentials encrypted per customer. For SAP ECC, it uses the on-premises agent (NCo or JCo) to invoke RFC/BAPI functions against the customer instance; the agent runs on the customer network and connects to SAP ECC via RFC protocol. For Dayforce, it refreshes the OAuth2 Bearer token before each sync cycle (tokens expire in one hour), retrieves and caches the customer-specific base URL daily to avoid redirect overhead, and polls Dayforce using filterUpdateDateRangeMin and filterUpdateDateRangeMax to fetch only changed records. Employee records from Dayforce are mapped to SAP ECC cost centers by org unit ID; payroll GL journals from Dayforce are mapped to SAP ECC GL accounts and cost centers via configurable cost center mappings. Every BAPI_ACC_DOCUMENT_POST call includes a REF_DOC_NO idempotency key derived from the Dayforce payroll batch ID and GL document ID, so a retry after a transient failure does not create duplicate postings. If an RFC call fails with SYSTEM_FAILURE or COMMUNICATION_FAILURE (which can happen under high concurrency), ml-connector backs off and retries with exponential jitter. All records carry a full audit trail, so downstream failures can be replayed.

A real-world example

A mid-sized discrete manufacturer runs SAP ECC on premises for production, procurement, and finance, and uses Dayforce in the cloud for payroll across three plants and a head office. Before the integration, the finance team exported payroll registers from Dayforce each pay period, manually mapped cost centers to SAP ECC dimensions, and re-entered labor totals into the general ledger by hand. Reconciliation took two days at month-end close because headcount in SAP ECC drifted from Dayforce, and the labor accounts rarely matched. With SAP ECC and Dayforce connected, each payroll run's GL journals post automatically into SAP ECC and allocate to the correct cost centers; employee terminations and rehires in Dayforce sync to SAP ECC immediately; and month-end close starts with the labor accounts already reconciled and the manual re-keying step eliminated.

What you can do

• •Poll Dayforce for employee and org unit changes on a daily or weekly schedule, then sync headcount and cost center masters into SAP ECC.
• •Post payroll GL journals from Dayforce into SAP ECC's general ledger, allocated to the correct cost center and GL account dimensions.
• •Map Dayforce org units and job codes to SAP ECC cost centers so payroll allocations land on valid accounting dimensions.
• •Refresh Dayforce OAuth2 tokens hourly and cache the customer-specific base URL daily to avoid redirect overhead.
• •Prevent duplicate GL postings on retry by using idempotency keys (REF_DOC_NO) derived from Dayforce payroll batch and document IDs.

Questions

Does the on-premises SAP ECC agent need to be installed and running for this integration to work?

Yes. SAP ECC exposes RFC/BAPI functions only through an on-premises agent (SAP .NET Connector or Java Connector), and the agent must be installed on the customer network and able to connect to the SAP ECC instance via RFC protocol. ml-connector calls the agent over the network to invoke BAPI functions; it does not run the agent itself.

How does ml-connector handle Dayforce OAuth tokens expiring every hour?

ml-connector refreshes the Bearer token before each sync cycle by posting to the Dayforce token server with the client credentials. Because tokens expire in one hour, the integration stores the token with its expiry time and requests a new token before the old one expires, so there is no gap in connectivity.

What happens if a payroll GL posting to SAP ECC fails partway through?

Every BAPI_ACC_DOCUMENT_POST call includes a REF_DOC_NO idempotency key derived from the Dayforce payroll batch and GL document ID. If a request fails and ml-connector retries, SAP ECC detects the duplicate REF_DOC_NO and does not create a duplicate posting. The full audit trail records the original attempt and the retry, so the finance team can see what happened.