SAP S/4HANA and ADP integration

What moves between them

The main flow runs from ADP into SAP S/4HANA. After each payroll run, ml-connector reads ADP general ledger documents and posts the labor cost journal entries into the SAP S/4HANA general ledger, mapped to the matching GL accounts and cost centers. Worker records flow the same direction so SAP cost center and headcount data reflects ADP hires, terminations, and rehires. Reference data such as cost centers and departments is aligned so payroll allocations land on valid SAP accounting dimensions. GL documents are read-only in ADP, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and presents the ADP client certificate at the TLS layer on every request, refreshing the ADP bearer token when a call returns 401. On the SAP side it caches the OAuth2 client-credentials token from the Communication Arrangement token endpoint and reuses it until it nears expiry. Because every SAP write needs an X-CSRF-Token, it issues a GET with X-CSRF-Token Fetch, carries the returned token and cookies into each journal entry POST, and re-fetches if a write returns 403. Posting through SAP's journal entry service also benefits from SAP's built-in duplicate detection, so a re-run does not double-post. Since SAP S/4HANA has no native webhooks, it polls OData on a schedule tied to your payroll calendar using a filter on the last change timestamp, and it can also receive ADP event notifications where they are enabled. Cost centers and departments are mapped first, so every payroll journal line references a GL account and cost center that already exists in SAP. Both ADP and SAP return HTTP 429 when throttled, so ml-connector backs off and retries, and it tracks the ADP certificate expiry so a renewal does not turn into an outage. Every record carries a full audit trail and can be replayed if a downstream call fails.

A real-world example

A mid-sized manufacturer with around 600 employees runs SAP S/4HANA Cloud for finance and procurement and uses ADP Workforce Now for payroll across several plants and a head office. Before the integration, the finance team exported payroll registers from ADP each pay period and re-entered the labor totals into SAP by hand, then spent the first days of month-end close chasing differences between HR headcount and the labor accounts in the ledger. With SAP S/4HANA and ADP connected, each payroll run's GL document posts into SAP automatically, allocated to the cost center for each plant, and worker changes keep the two systems aligned. Month-end close starts with the labor accounts already reconciled, and the manual re-keying step is gone.

What you can do

• •Post ADP payroll general ledger documents into the SAP S/4HANA general ledger after every pay run, allocated to the correct cost centers.
• •Keep SAP S/4HANA cost center and workforce records aligned with ADP hires, terminations, and rehires.
• •Map ADP cost centers and departments to SAP GL accounts and accounting dimensions so payroll lands on valid accounts.
• •Bridge ADP OAuth2 and mutual TLS with SAP OAuth2, and fetch the X-CSRF-Token SAP requires before every write.
• •Poll SAP on a schedule tied to your payroll calendar, with retries and a full audit trail on every record.

Questions

Which direction does data move between SAP S/4HANA and ADP?

The main flow is ADP into SAP S/4HANA. Payroll GL documents and worker records move from ADP into SAP, while cost centers and departments are aligned so payroll posts to valid dimensions. ADP general ledger documents are read-only, so ml-connector does not write financial entries back into payroll.

Why does posting to SAP S/4HANA need an X-CSRF-Token?

SAP S/4HANA rejects any write that does not carry a valid X-CSRF-Token and returns HTTP 403. ml-connector fetches the token on a prior GET, carries it and the session cookies into each journal entry post, and re-fetches automatically if a write is rejected so the posting does not fail.

Does ADP's mutual TLS certificate requirement need special setup?

Yes. ADP requires a client certificate at the TLS layer on every call in addition to OAuth2 credentials, and the connection fails without it. ml-connector stores the certificate encrypted, presents it on each request, and tracks its expiry so a renewal is handled before it can cause an outage.