SAP ECC and Deel integration

What moves between them

The main flow runs from Deel into SAP ECC. After each payroll run, ml-connector reads Deel invoices and payslips, extracts the GL account postings and cost allocations, and posts them into SAP ECC's general ledger using BAPI_ACC_DOCUMENT_POST, mapped to the correct SAP cost centers and accounts. Employee records flow the same direction so SAP headcount reflects Deel hires, terminations, and role changes. Reference data such as cost centers and GL accounts are aligned in both directions so payroll allocations land on valid SAP dimensions. Deel's invoice and payslip data is read-only, so ml-connector never writes financial transactions back into Deel.

How ml-connector handles it

ml-connector stores both credential sets encrypted and connects to SAP ECC via an on-premises agent (SAP .NET Connector or Java Connector) that runs on the customer's network, since RFC calls cannot originate from the cloud. It authenticates to SAP with HTTP Basic Auth and calls RFC_READ_TABLE to poll SAP cost centers, GL accounts, and employee data on a schedule. On the Deel side it presents the Organization Token or refreshes the OAuth2 access token when a call returns 401, and can also receive Deel webhook events for real-time employee and contract changes. When posting labor journals to SAP, ml-connector batches GL line items using BAPI_ACC_DOCUMENT_POST and always calls BAPI_TRANSACTION_COMMIT to persist the document, since SAP leaves uncommitted documents in a locked state. It maps Deel cost allocations to SAP cost centers before posting, validates GL accounts exist, and handles SAP ECC's 512-character RFC_READ_TABLE row width limit by using BBP_RFC_READ_TABLE for wide tables. Deel Idempotency-Key headers prevent duplicate postings on retry, and ml-connector tracks both systems' rate limits and backs off on 429 responses.

A real-world example

A global consumer goods manufacturer runs SAP ECC on-premises for finance and procurement across six regional plants, and uses Deel for payroll and HR management across four countries with different tax and compliance rules. Before the integration, the finance team received payroll summaries from Deel via email, manually entered labor cost allocations into SAP by plant and cost center each month, and spent the first week of month-end reconciling headcount between HR records and the SAP labor accounts. With SAP ECC and Deel connected, payroll GL postings flow directly into SAP allocated to each plant's cost center after each pay run, and employee hires and terminations update SAP headcount the same day. The finance team's month-end close now starts with labor accounts reconciled and headcount already aligned, eliminating the manual entry and reconciliation step.

What you can do

• •Post Deel payroll invoices and GL postings into SAP ECC's general ledger after each pay run, allocated to the correct SAP cost centers and GL accounts.
• •Keep SAP ECC employee records synchronized with Deel hires, terminations, and role changes across all four countries.
• •Map Deel cost allocations to SAP cost centers and validate GL accounts before posting, preventing posting errors and reconciliation gaps.
• •Authenticate SAP ECC via on-premises RFC agent with HTTP Basic Auth and Deel via Organization Token or OAuth2, with automatic token refresh on 401.
• •Poll SAP on a schedule or receive Deel webhook events for real-time employee updates, with full audit trail and automatic retry on network failure.

Questions

What is the on-premises agent requirement for SAP ECC integration?

SAP ECC is an on-premises system that does not expose a cloud REST API. RFC and BAPI calls cannot originate from the cloud and require the SAP .NET Connector or Java Connector to run on the customer's network. ml-connector connects through that agent, which handles the low-level RFC protocol, so the integration can run from the cloud while speaking RFC to the on-premises SAP instance.

Does ml-connector handle Deel's OAuth2 token refresh and idempotency?

Yes. ml-connector refreshes Deel's OAuth2 access token when a call returns 401 and automatically retries the original request with the new token. For GL postings, it includes Deel's Idempotency-Key header (24-hour TTL) to prevent duplicate documents if a retry occurs.

How does the integration handle SAP ECC's requirement to commit GL documents?

SAP BAPI_ACC_DOCUMENT_POST requires an explicit BAPI_TRANSACTION_COMMIT call to persist each document; without it, the document remains locked and locked documents block month-end close. ml-connector always calls BAPI_TRANSACTION_COMMIT immediately after posting a labor journal, so documents are committed atomically and month-end reconciliation can proceed on schedule.