Marketing Cloud Connect User Types and Permissions

Marketing Cloud administrator

The Engagement admin sets up and configures the Engagement account and users. This admin works with the Salesforce CRM administrator to install and set up Marketing Cloud Connect.

Salesforce CRM (Sales or Service Cloud) administrator

The Sales or Service Cloud admin sets up and configures a Salesforce CRM account and users. This admin works with an Engagement administrator to install and set up Marketing Cloud Connect.

Marketing Cloud Connect API user

The Marketing Cloud Connect API user completes the account-level connection between the Sales or Service Cloud and Marketing Cloud. If possible, use a dedicated system user as the Marketing Cloud Connect API user. If the Sales or Service Cloud org is connected to a Marketing Cloud Enterprise 2.0 account, the Marketing Cloud Connect API user’s business unit access in the Marketing Cloud determines which business units are available for use within the Sales or Service Cloud.

Salesforce system user

This Sales or Service Cloud user, previously called the tracking user, is required to complete the account-level connection between Engagement and Sales or Service Cloud. This user makes Marketing Cloud tracking data available in CRM. This user type is exclusively for sending to CRM audiences from Engagement in non-scope-by-user accounts. If possible, use a dedicated system user as the Salesforce system user, which does consume a user license.

Marketing Cloud Connect administrator

This person manages the setup of Marketing Cloud Connect within the Sales or Service Cloud.

Marketing Cloud Connect user

This person accesses Marketing Cloud Connect functionality in the Sales or Service Cloud, Engagement, or both. Access to Marketing Cloud Connect functionality in the Sales or Service Cloud is managed through CRM permissions and page layouts. Access to Marketing Cloud Connect functionality in Engagement is managed through Marketing Cloud Connect permissions. A license for both Engagement and Sales or Service Cloud is required at a minimum.

Marketing Cloud for AppExchange Admin Permission

This Salesforce CRM admin permission lets admins view all data and send to any contact, lead, campaign, or report.

Marketing Cloud for AppExchange User Permission

This non-admin permission lets Salesforce CRM users access the Marketing Cloud Connect interface, enabling them to perform sends. If the account is configured as “scope by user,” users view and send to only the records they own.

Connected App Authentication Permission

The Salesforce CRM admin creates this permission set during Marketing Cloud Connect installation and setup. Assign this permission to all Marketing Cloud Connect users. The connected app manages all cross-cloud authentication from Engagement into Sales or Service Cloud.