Overview
Marketing Cloud Account Engagement1, the B2B marketing automation platform in the Salesforce ecosystem, is most often used by marketing and sales teams within an organization. However, individuals within those two teams generally have different access needs within the tool. Taking advantage of roles and permissions within the platform can protect the system as well as its users as part of an instance built for scale.
Planning and Controlling System Access
User roles provide holistic rights across a feature, object or aspect of the platform. Account Engagement comes with four standard roles: Administrator, Marketing, Sales Manager and Sales, in order of decreasing levels of access. User roles don’t customize access to specific object records, but folders and user groups can be leveraged for this purpose.
Reducing Mistakes and Confusion
Applying user roles and permissions properly can reduce the chance of an unintentional system configuration change or object edit that breaks existing marketing automation processes. Mistakes could jeopardize the marketing operations team’s ability to meet business goals and may take significant time and effort to correct. From a user standpoint, having appropriately-sized permissions can avoid confusion by showing only the items they need and not cluttering their workspace with options they shouldn’t explore.
Continuous Permissions Re-evaluation
The initial Account Engagement implementation is the perfect time to evaluate user access needs and set up the necessary roles. Reviews and modifications may take place annually to make sure everything is running smoothly for the organization over time. Occasionally, an unexpected situation may highlight mismatched access and should result in a speedy – but thoughtful – adjustment.
Permissions Options in Account Engagement
The principle of least privilege suggests that users should be given only the minimum access needed to complete their tasks. Consider which of the roles would give them the access they need and not aspects they don’t need. You should never give Administrator access to many, let alone all users. It’s a good idea though to have more than one Administrator within an organization to cover out-of-offices and emergencies.
If none of the out-of-the-box roles are quite the right fit to apply the principle of least privilege, custom user roles are an option. It’s often simpler to base a custom role on an existing role that most closely matches the desired permissions mix. Clone the existing role and simply make the modifications needed for the custom role. Important to note is that custom roles are included only with Account Engagement Advanced Edition, and are available for an additional cost with Account Engagement Plus Edition. Companies with a need for custom roles will want to make sure they have one of these two Account Engagement editions.
In order to allow access to certain records and not others within the same object, such as individual forms or campaigns, items must be organized in folders and then groups given permissions on the folders. Note that prospects can’t be put into folders and thus access to them can’t be managed using this method. To create a group for folder access purposes, navigate to User Management > Add User Group under Admin/Settings. Then build out the folder structure to represent the separate access groups, and edit the Permissions setting for the highest-level folder that distinguishes the separate sections to add the corresponding user group. The subfolders will inherit the permissions.
Carefully consider the correct access level needed at the time of a user’s creation. But if a person’s role changes, their access may need to change, and if they leave the organization their access should be revoked. Automating license provisioning by hooking into an active directory or similar system would be ideal. If appropriate, enabling the User Sync feature will remove duplicative steps by managing Account Engagement and Salesforce user permissions concurrently through profiles. With this option, user details and access will stay synced between the two systems.
Marketing Operations Governance
Marketing operations should own the administrative tasks in the MAP, including the company’s process for determining and assigning roles and permissions. As such, they are responsible for governance of the access process. If leveraging User Sync, MOPs will work with the Salesforce administrator to plan and map profiles.
Conclusion
Account Engagement standard and custom user roles, in conjunction with user groups and foldering, allow control over access to different aspects of the platform. Marketing operations teams can protect their automation efforts and platform investment, and simplify the experience for users.
1In April 2022, Salesforce renamed Pardot to Marketing Cloud Account Engagement.
