SAP S/4HANA and Dayforce integration

What moves between them

The main flow is Dayforce into SAP S/4HANA. After payroll closes in Dayforce, ml-connector polls for GL documents, payroll journals, employee roster changes, and cost allocations. Each journal entry is mapped to the matching GL account and cost center in SAP S/4HANA and posted as a journal entry line. Employee changes such as hires, terminations, and cost center moves are read so SAP headcount and cost assignments stay aligned with the payroll system. Reference data such as cost centers and org units are aligned in both directions so payroll allocations land on valid SAP dimensions. GL postings are read-only in Dayforce, so ml-connector never writes financial entries back into payroll.

How ml-connector handles it

ml-connector stores both credential sets encrypted and uses the correct OAuth flow for each side: Client Credentials with refresh logic for SAP S/4HANA, and Resource Owner Password Credentials with hourly re-authentication for Dayforce. The Dayforce client-specific API URL is cached and refreshed daily to avoid redirect overhead. On the SAP side, it caches the tenant-specific token endpoint and refreshes tokens before expiry, typically every 12 hours. Because Dayforce is poll-only, ml-connector fetches payroll GL documents and employee data on a schedule you control, typically triggered after payroll closes each pay period. Cost allocations from Dayforce are mapped to SAP S/4HANA cost centers and GL accounts first, so every payroll journal line references a valid GL account and cost center already present in SAP. Dayforce GL codes are validated against SAP's GL account master before posting. Rate-limit retries and token-refresh retries are automatic, and every record carries a full audit trail and can be replayed if a downstream GL post fails.

A real-world example

A mid-sized consumer goods company runs SAP S/4HANA for finance, supply chain, and cost accounting across a North American manufacturing footprint with four plants and a head office. Dayforce manages payroll, benefits, and workforce scheduling across all sites. Before the integration, after each bi-weekly payroll run the finance team manually pulled payroll GL codes and amounts from Dayforce, reconciled them to cost centers by plant, and re-entered the labor cost journals into SAP, a process that took eight hours and was error-prone. With SAP S/4HANA and Dayforce connected, each payroll GL document flows automatically into SAP allocated to the correct plant cost center, and employee roster changes keep department headcount in SAP aligned with active payroll records. The finance team now starts month-end close with payroll GL accounts already reconciled, and the manual re-entry step has been eliminated.

What you can do

• •Post Dayforce payroll GL documents into SAP S/4HANA's journal entry ledger after every pay cycle, allocated to the correct cost centers and business units.
• •Keep SAP S/4HANA employee count and cost center assignments aligned with Dayforce hires, terminations, and cost center changes.
• •Map Dayforce cost allocation codes and GL codes to SAP S/4HANA GL accounts and cost centers so payroll journals land on valid accounts.
• •Authenticate SAP S/4HANA with OAuth 2.0 Client Credentials and Dayforce with OAuth 2.0 Resource Owner Password Credentials, with automatic token refresh before expiry.
• •Poll on a schedule tied to your payroll calendar, with automatic retries on rate limits and a full audit trail on every record.

Questions

Which direction does data move between SAP S/4HANA and Dayforce?

The main flow is Dayforce into SAP S/4HANA. Payroll GL documents, employee records, and cost allocations move from Dayforce into SAP S/4HANA, while cost centers and GL accounts are validated and aligned in both directions to ensure payroll lands on correct accounts. GL postings are read-only in Dayforce, so ml-connector does not write financial entries back into payroll.

How does the integration handle different OAuth flows on each side?

ml-connector uses OAuth 2.0 Client Credentials for SAP S/4HANA, where the integration credentials are registered in SAP's Communication Arrangement. For Dayforce, it uses OAuth 2.0 Resource Owner Password Credentials with a Dayforce integration user account. Tokens are cached and refreshed before expiry: SAP tokens typically last 12 hours, while Dayforce tokens expire in 1 hour and are re-requested automatically.

How does the integration work with Dayforce's changing client API URL and SAP's tenant-specific token endpoint?

ml-connector caches the Dayforce client-specific API URL and refreshes it daily to avoid redirect overhead, since the URL can change if Dayforce optimizes tenant routing. For SAP S/4HANA, the token endpoint URL is copied from the Communication Arrangement at integration setup and is consistent per tenant, but tokens are refreshed before expiry to prevent authentication failures.