Mandatory IP Allowlisting in Marketing Cloud Engagement

To enhance the security of the Salesforce platform, Salesforce will require that all Marketing Cloud Engagement accounts use the login IP allowlist in blocking mode. This security control prevents unauthorized UI and API access to your account.

This rollout involves two stages with different schedules: 

1. Initial availability of Salesforce generated recommended IP ranges for admins to review and accept. See the Availability of Recommended Baseline IP Lists  below. 

2. Salesforce automatically enforces the “Log Violation and Deny Access” (blocking mode) settings when customers have not already enabled. This control will be enforced in a phased rollout over the coming months, and affected customers will receive communications prior to their specific enforcement dates.   

We highly recommend that customers proactively prepare by reviewing and accepting Salesforce-recommended IP ranges, enabling “Log Allowlist Violations” (monitoring mode) to refine their ranges, and ultimately enabling blocking mode themselves to avoid disruption.

What’s Changing

Stage 1) Salesforce Recommended IP Ranges Initial Availability: Salesforce provides a recommended list of IP ranges for admins to review and accept. These suggestions are based on successful authentications from the past six months, excluding known malicious addresses. Note that Salesforce’s recommendations are only available if the total is under 100 unique IP ranges. Salesforce-suggested IP ranges don't override any IP ranges already configured in the allowlist. 

Stage 2) IP Allowlist Blocking Mode Enforcement. By January , 2027,  Salesforce will mandate Log Violation and Deny Access (blocking mode) in accounts where it isn't enabled. When this setting is on, users can log in only from IP addresses on the allowlist. Review and validate the recommended IP ranges, and use Log Allowlist Violations (monitoring mode) to test and refine IP ranges.

There is no change for accounts that already use blocking mode with the login IP allowlist.

Why Is Salesforce Making This Change

To uplift the security of the Salesforce platform, we are mandating the use of IP allowlisting in enforcement mode by all Marketing Cloud Engagement customers. This security tool contains and prevents the recurrence of security incidents.

When Does Enforcement Take Effect

Customers will be notified via email when an enforcement date has been set for their instance to enable blocking mode.

Who’s Affected

This change affects Marketing Cloud Engagement customers whose IP allowlist is not enabled or is set to monitoring-only mode at the enterprise or business unit level. 

What to Expect With IP Allowlist Blocking Mode Enforcement

Salesforce is enforcing this security control in phases. We will notify you by email when an enforcement date is set for your account.

Enterprise (EID) Level: We will enable blocking mode for your EID.

• If your EID is already in Log Violations and Deny Access (blocking mode), your settings don't change.

• If your EID is in IP Allowlisting Disabled or currently has no IP list, we will enable blocking mode and apply Salesforce-recommended baseline IP ranges.

• If your EID is in Log Allowlist Violations (monitoring mode), we will enable blocking mode, keep your existing list, and append Salesforce-recommended IP ranges to ensure continued access.

Business Unit (MID) Level: We will enable blocking mode for BUs that have a current business unit level configuration. 

• If your BU is already in blocking mode, your settings don't change.

• If your BU is in monitoring mode, we will switch it to blocking mode and append Salesforce-recommended IP ranges to your existing IP list.

• If the allowlist is disabled in your BU, we will switch it to blocking mode with the Enterprise level list source.

All other business units inherit the enterprise-level IP allowlist configuration.
Note: The recommendations are provided at the EID level, not at the individual BU level.