The other day, I was at a fun Marketo User Group where we discussed what not to do in Marketo. Outside of the April Fool’s Day post, what else should you consider not doing in Marketo and other marketing automation platforms?

Allow Everyone to Delete

This level of access is easy to overlook depending on the system. In Marketo, the Delete Lead right is under Lead Database even though you can do this from a variety of screens. It’s also easy to overlook because the default settings allow nearly everyone to do this. And who would delete a lead without a good reason?

Turns out, it is very easy to delete leads improperly! Here’s quick story to illustrate why you should immediately remove Delete Lead from every user other than Administrators:

A person uploads a list to your database and realizes the list is in the wrong Program. The leads are now Members of that Program as well as that List. The person does Select All>Delete Lead in SFDC as a Single Flow Action.

Experienced Marketo Users, in fact, all Certified Users should know that Membership of Programs and Lists has nothing to do with the Lead itself. The correct action is to clone the List to the correct Program, or take the email addresses and re-upload that column to the correct Program. Then you can run a Program Status>Not in Program to remove the incorrect placement. Only then can you delete the original Static List. There is no reason to delete leads in this situation.

The permission to delete Leads can also pose a larger security risk if you forget to remove access for disgruntled contractors or staff.

Allow Download Leads for Everyone

While less risky in some situations than deletion, there are still plenty of people willing to run an export on your database and walk away with the leads. You may never know this occurred. The critical risks are people walking away with your email list to sell it to the highest bidder. If you also put more sensitive information in the MAP such as credit cards or identity numbers, then you just put your clients at risk of identity theft. The liability here can be tremendous, even with airtight contracts and insurance. Best to lock down your Roles such that only trusted staff can export data to encrypted drives.

Now that Marketo has the Audit Tool, you should use it occasionally to see if anything is amiss.

Forget to Sweep the User List Regularly

I personally do this about once a month. It’s unlikely IT or HR will ever remind you that so-and-so left the company. And don’t rely on word of mouth for this either. Not everyone who leaves does so with a goodbye note.

The other day I decided to walk through the entire user list. I removed seven people and set time limits on several more as I realized just how many people should no longer have access.

Tricks to doing this quickly:

• Sort by Last Login Date (see below)
• Look for Users who never logged into the original invitation (First Login Date)
• Sort by Name
• Always note contractors by firm Name in Last Name or Reason

Give Out Admin Access Like Candy

Not that you should give out candy to anyone…but I’ve seen a lot of situations where SFDC Admins and Marketo Admins were in abundance for no particular reason. One firm had nearly everyone, including Salespeople, as Administrators in SFDC. Another Marketo instance had 10 admins, including contractors that weren’t doing much anymore. If you are an Administrator, you should ask people to justify the access requirement while training them and watching to see if they are trustworthy. Always begin with the lowest possible access level and make people call you with the need for more access. This is not just about untrained users, it’s about compartmentalizing the risk if a hacker obtained access through a user.

Remove API Users

The big caveat to user sweeps is API Users. Good Admins will name the user “Website API User”. However, the API users never trigger a Last Login Date, so it’s easy to see that and remove the User before figuring it out.

Not Customize Roles

I suspect in most MAPs there is a similar tool to Marketo’s Role tab. The default Roles are not well differentiated from each other. The defaults also are very permissive other than Analytics and Web Designer. Essentially, everyone can do nearly everything. Here are some thoughts:

Use or Allow the Run Single Flow Action

Don’t ever do this. Ever.

When I first started to use Marketo, I did this occasionally on small groups of leads because it is easier than building a whole smart campaign to do the same thing. As I learned more, however, I saw that using this feature meant that reversing the Change or finding these leads again became nearly impossible – once the data changes, the smart list might no longer display these leads.

For example, if you Run a Single Flow action with Change Data Value (or Delete Lead), the system just runs it immediately. Since there is no Smart Campaign, there is no reference point such as Member of Smart Campaign to find these leads again if you need to do so. There’s no audit trail good enough to find this group easily, or at all.

In other words, it is a dangerous tool even in the hands of an experienced user. Restrict it to Admins and even Admins should never use it.

Automate Deletion of Junk Leads

This automation is tempting. You pre-suppose you know exactly which leads are Junk somehow. How sure are you of your database matching skills? What if something else goes awry and triggers deletion on real leads? For example, I once modified a Lifecycle Stage incorrectly, pushing 4,000 records into a Delete Wait Step…fortunately I had a few days to uncover the error. Deletion is much better as a careful process that includes backup steps outside of the MAP.

Do you have other “What not to do tips” for the rest of us? Put them in the comments below!