How to Set Up Users, Roles and Business Unit Access in Salesforce Marketing Cloud Engagement

Set up Marketing Cloud Engagement access by defining the Enterprise business-unit structure, creating user accounts, assigning business-unit access, and assigning roles with the required permissions. The Marketing Cloud administration model uses business units, users, roles, and permissions to control account access.

Define the Enterprise and Business Units

An Enterprise account can contain multiple business units. Use business units to separate marketing operations that require distinct ownership, such as brands, regions, or departments within the same Enterprise account.

Define the business-unit structure before assigning access. Each business unit should have a clear operating owner so that access decisions do not become tied to temporary campaigns or individual projects.

Create Users and Assign Roles

Users are the individual accounts that access Marketing Cloud Engagement. Roles group permissions, and role assignments determine the areas and actions available to a user.

Create each user account in the account administration area, then assign the role required for that person’s responsibilities. Keep roles focused on the work users need to perform rather than assigning broad administrative access by default.

Use separate role assignments for distinct responsibilities:

• Administrators manage account configuration and user access.
• Marketing users receive access to the marketing functions required for their work.
• Developers receive access required for approved development and integration work.
• Review-only users should not receive configuration or publishing access.

Assign Business Unit Access

After creating the user, assign access to the business units where that user must work. Business-unit access should reflect the organization’s operating model, while the user’s assigned role controls the permitted actions.

For an illustrative access model, a central administrator can be assigned broader access, while a regional marketer is assigned only to the business unit that team operates. Document the required business units, users, roles, and restricted permissions before applying the assignments.

Verify Access Before Releasing Work

Test each intended role and business-unit assignment with a representative user account. Confirm that the user can work in the intended business unit and can complete the approved actions without receiving unnecessary access.

If a user can log in but cannot open a feature or complete an action, review the user’s business-unit access and role permissions before changing the implementation. Check the following:

• The user is working in the intended business unit.
• The user has access to that business unit.
• The assigned role includes the permission required for the operation.
• The account structure matches the asset or process being configured.
• Development access is not being confused with administrator access.

Administration Sequence

• Define the Enterprise and business-unit structure.
• Create the required user accounts in account administration.
• Assign each user access to the required business units.
• Assign roles based on the user’s responsibilities.
• Test representative administrator, marketer, developer, and review-only access.
• Remove permissions that are not required for a role.

Share With Others