Loading
Salesforce now sends email only from verified domains. Read More

Data 360: Troubleshooting Data 360 Sandbox-to-Marketing Cloud Connection Issues

Publish Date: Jan 29, 2026
Description

When attempting to connect Marketing Cloud from a Data 360 (formerly Data Cloud) Sandbox org, here are a few key things to keep in mind:

  1. Account Compatibility:

    • Data 360 supports only Engagement Enterprise 2.0 accounts.

  2. Connected User Permissions:

    • Ensure that the user initiating the connection holds both Administrator and Engagement Administrator roles in Marketing Cloud.

    • Roles in Marketing Cloud Engagement are scoped by Business Unit, so the user must have appropriate roles assigned at both the EID and any specific BUs involved in the connection.

    • For best results and to avoid downstream connection issues, use a dedicated Marketing Cloud API user account with non-expiring credentials to avoid disruptions due to password expiration. Avoid using shared or personal credentials during integration, as these may expire or be reassigned, impacting service continuity.

    • It is highly recommended that a standard role is used for the connecting user, however, in cases where a custom role is used, the granular permissions assigned to this user must mimic that of an Admin user.

    • Default Business Unit Setting: Ensure the Engagement user’s default BU is set to the Enterprise business Unit (EID) as all connections flow through the Enterprise-level BU.

  3. IP Allowlisting:

    • Data 360 communicates with Marketing Cloud via a dynamic range of IP addresses that may change approximately every 90 days.

    • If IP allowlisting is enforced in Engagement, regularly update the IP list to avoid disruptions.

    • Refer to this link for the latest IP addresses: IP Addresses Used by Data 360 Services.

  4. Business Unit-Level Access:

    • When a Sandbox org is created, Data Streams are copied over from Production — but the authentications are not.

    • As a result, Data 360 attempts to validate access to the same BUs configured in Production. If the connected user lacks access to those BUs, connection errors may occur when attempting to authenticate the connection in Sandbox.

    • To resolve this:

      • Ensure the Engagement user has access to all Business Units referenced by existing Data Streams.

      • If access cannot be granted, delete any Data Streams associated with inaccessible BUs before reconnecting Marketing Cloud in the Sandbox.

Resolution

Connecting Data 360 Sandbox to Marketing Cloud: Essential Checklist

  1. User Roles and Permissions

    • Verify the user has the required roles at both the EID and BU levels.

    • Use a dedicated API user to avoid issues with role changes or credential expiration.

    • Ensure the user establishing the connection is assigned both the 'Marketing Cloud Admin' and 'Administrator' roles. If a custom role is being used instead, verify that it includes all necessary granular permissions to fully replicate the access levels of the standard Admin roles.

  2. IP Allowlisting

    • Confirm current IP restrictions in your Marketing Cloud org, if any.

    • Add a process to regularly update the Data 360 IP ranges.

  3. Business Unit and Data Stream Management

    • Ensure all referenced BUs and the Data Extensions corresponding to the Data Streams are accessible or remove related Data Streams that were cloned from Production.

    • Never modify Data 360-generated automations—they are essential for data sync.

     

Knowledge Article Number

004634398

 
Loading
Salesforce Help | Article