Regarding permission changes and best practices for Standard Roles in Marketing Cloud Engagement

Role Permissions and Best Practices in Marketing Cloud Engagement

Marketing Cloud Engagement provides several system-defined roles, which are categorized into Marketing Cloud Roles and Email Studio Roles.

In Marketing Cloud Engagement, a "System Administrator" typically refers to a user assigned both the "Marketing Cloud Administrator" (Marketing Cloud Role) and the "Administrator" (Email Studio Role).

While the permissions for the "Marketing Cloud Administrator" role cannot be modified, the "Administrator" role in Email Studio allows for permission adjustments. However, you should never directly modify the permission settings of system-provided roles. Direct modification carries the following risks:

• No Reset Functionality: Once you change the permissions of a standard role, there is no "Reset" button to restore it to the system default. Reverting it requires manual adjustment, but accurately identifying the original default state is extremely difficult.

• Troubleshooting Obstacles: When permission-related errors occur, a standard troubleshooting step is to assign the default administrator roles (Administrator + Marketing Cloud Administrator) to see if the issue persists. If the standard roles themselves have been modified, this diagnostic step becomes unreliable.

Recommended Solutions:

• Use Custom Roles: The best practice is to create Custom Roles, configure them with the necessary permissions, and assign those to your users.

• Avoid Direct User Permissions: While it is possible to assign permissions directly to a specific user, this should only be done for testing purposes. For production environments, always manage access through Custom Roles.

Important Note:

Do not assign all available roles to a single user. Assigning every role to a user can lead to permission conflicts. In some cases, this may result in the user being locked out of the Administrator Setup menu entirely.