Loading

Marketing Cloud Connect | Risks and Recommended Configuration for the API User

Дата публикации: Jul 15, 2026
Описание

When configuring Marketing Cloud Connect (MCC), using the same account for both the MCE or Salesforce Platform API user and an individual's admin user is not recommended. The best practice for a stable integration is to create dedicated API users separately for both the MCE and Salesforce Platform environments.

In some cases, license constraints may require using the API user with an individual's admin user account. Review the following considerations carefully and proceed with the understanding that risks exist.

Note: The risks listed below are not exhaustive — they represent commonly observed cases.

Решение

Risks of Sharing the MCE API User with an Individual's User Account

1. Security Settings Related to Password Expiration

When the API user's password expires, the authentication token between Salesforce Platform and MCE can no longer be refreshed, causing the integration to disconnect.

To avoid this, some organizations exclude the API user from password expiration policies under Security Settings. However, if the user is an individual's admin user, applying this exclusion conflicts with the requirement for that individual user to change their password regularly.

2. Integration Downtime and Rebuild Costs Due to Resignation

If the API user is shared with an individual's admin user account and that person resigns, or requires a username change, you must fully disconnect and reconnect with the new API User on Salesforce Platform under the Marketing Cloud tab.

See: Remove Configuration Settings in Salesforce for Marketing Cloud Connect

Risks of Sharing the Salesforce Platform API User with an Individual's User Account

1. Conflicts with API Limits and Login Rate Limits
The Salesforce Platform integration user logs in to Salesforce Platform automatically in the background every few minutes to communicate with MCC. If an individual uses the same account for daily operations, multiple simultaneous logins from different systems can occur, potentially exceeding Salesforce Platform's login rate limits or API limits. This can cause not only the MCC integration but also other systems and the individual's own operations to stop.

See: Sign-in Error: "Login Rate Exceeded"

2. Integration Disruption and Reconnection Cost Due to Resignation
If the API user is shared with an individual's admin user account and that person resigns, or requires a username change, you must fully disconnect and reconnect the Connected App on the MCE side.

Reconnecting incurs the following costs:
  1. Data loss and rebuild of synchronized Data Extensions — disconnecting requires reconfiguring all synchronized Data Extension sync settings.
  2. Interruption of active Journeys — any Journey using Salesforce Platform data as an entry source is interrupted, requiring a new version to be created with the entry source reconfigured.
  3. Impact on automations and queries — any SQL query or automation referencing a synchronized Data Extension returns errors, requiring updates to all references after reconnection.

Recommended Configuration

When deploying MCC, create dedicated API users — separate from any individual's admin user accounts — for both the MCE and Salesforce Platform environments, and use those to configure the integration.

Separating individual's admin user accounts from API user accounts ensures a stable integration that is not affected by personnel changes, resignations, or password policy updates.

In addition, separating accounts makes it easier to distinguish the root cause of issues when they occur — system-generated automation logs and admin manual operation logs are no longer recorded as actions by the same user.
Номер статьи базы знаний

005388828

 
Загрузка
Salesforce Help | Article