SAP S/4HANA and UKG integration

What moves between them

The main flow runs from UKG into SAP S/4HANA. After each payroll run, ml-connector reads UKG's GL journal export and posts the labor cost journals into SAP S/4HANA's general ledger, mapped to the matching SAP cost centers and GL accounts. Employee records flow the same direction so SAP headcount reflects UKG hires, terminations, and status changes. Cost centers and pay groups are read from UKG and validated against existing SAP cost centers so payroll allocations land on valid dimensions. GL postings are read-only in UKG, so ml-connector never writes financial entries back to payroll. The sync runs on a schedule tied to your payroll calendar.

How ml-connector handles it

ml-connector stores both OAuth credential sets encrypted and refreshes tokens on both sides when calls return 401 or when expiry approaches. On the SAP side, it accepts the tenant-specific base URL and Communication Arrangement scope, and validates entity paths against that instance. On the UKG side, it implements the two-pass employee fetch (first call to /personnel/v1/employee-ids for internal UUIDs, second call per employee to /personnel/v1/employees/{id} for full profile), and handles both HTTP Basic Auth (for core REST) and OAuth 2.0 (for webhooks and GL exports). Cost centers and pay groups are aligned first, so every payroll journal line references a GL account and cost center that already exists in SAP. Because SAP S/4HANA is pull-only (no webhooks), ml-connector polls UKG's GL export and employee change data on a schedule, not in real-time. UKG webhook events carry a 14-day retention, so ml-connector also implements polling as a secondary mechanism to ensure no records are missed. Every record carries a full audit trail and can be replayed if a downstream SAP posting fails.

A real-world example

A global discrete manufacturer runs SAP S/4HANA for procurement, inventory, and finance across four plants and a shared services center, and uses UKG for payroll and HR across all locations. Before the integration, the accounting team exported payroll registers from UKG every pay period and manually entered labor cost totals into SAP cost center accounts, then reconciled headcount differences at month-end. With SAP S/4HANA and UKG connected, each payroll run's GL journal flows into SAP automatically, allocated to the cost center for each plant location, and new hires, terminations, and transfers keep SAP headcount current. Month-end close begins with labor accounts already reconciled and employee counts matching, eliminating the manual re-entry step and chasing.

What you can do

• •Post UKG payroll GL journals into SAP S/4HANA's general ledger after each pay run, allocated to the correct cost centers.
• •Keep SAP S/4HANA headcount and employee records aligned with UKG hires, terminations, and status changes.
• •Map UKG cost centers and pay groups to SAP S/4HANA cost center dimensions so payroll allocations land on valid accounts.
• •Authenticate both systems using OAuth 2.0 Client Credentials with tenant-specific URLs and token refresh on both sides.
• •Poll on a schedule tied to your payroll calendar, with secondary polling backup for UKG's 14-day webhook event retention.

Questions

Which direction does data move between SAP S/4HANA and UKG?

The main flow is UKG into SAP S/4HANA. Payroll GL journals and employee records move from UKG into SAP, while cost centers are validated in SAP to ensure payroll allocations land on valid accounts. GL postings are read-only in UKG, so ml-connector does not write financial entries back to payroll.

Does SAP S/4HANA support real-time webhooks for this integration?

No. SAP S/4HANA has no native webhooks, so ml-connector polls UKG on a schedule tied to your payroll calendar instead of waiting for a push from SAP. UKG does offer webhooks, but they carry a 14-day retention, so ml-connector also implements polling as a secondary mechanism to ensure zero records are lost.

How does ml-connector handle the two-pass employee fetch and OAuth refresh on both sides?

ml-connector first calls UKG's /personnel/v1/employee-ids endpoint to fetch internal employee UUIDs, then makes a second call per employee to /personnel/v1/employees/{id} for full profile details. On both SAP and UKG sides, it caches OAuth tokens and refreshes them when calls return 401 or when expiry approaches, ensuring continuity across token boundaries (SAP tokens typically last 12 hours; UKG tokens expire in 1 hour).