Assign Marketing Cloud Engagement Roles and Permissions

Learning Objectives

After completing this unit, you’ll be able to:

Define options for permissions.
Identify standard Marketing Cloud Engagement roles.
Consider custom roles.

Marketing Cloud Engagement User Management

User creation and management are key tasks for a Marketing Cloud Engagement admin. Once a user is created, a role is assigned to allow access to features and actions they need to complete their work. This module reviews Marketing Cloud Engagement user roles and associated permissions to help you complete this task.

Check out the Marketing Cloud Engagement Setup module to learn more about Marketing Cloud Engagement admin responsibilities.

Role-Based Permissions

Roles are established to define a user’s permissions within Marketing Cloud Engagement. A permission is a granular way of controlling access to a specific object and actions within a feature or application. For example, a permission can restrict a user from deleting a data extension in Email Studio. In other words, the permission controls access to three things.

Object: Data Extension
Action: Deletion
Application: Email Studio

To mitigate risk and protect account security, deny access takes priority over allow access. When assigning permissions, use the Principle of Least Privilege. This means you assign only the access a user needs to do their job, and nothing more. There are three options for granular permissions.

Allow: The user can see and take action on that permission (like delete a data extension).
Deny: The user does not have permission to see a button or do an action (like deletion).
Not Specified: The user may see the button, but no action can be taken.

Marketing Cloud Engagement Roles

Since Marketing Cloud Engagement has many available permissions, standard roles have been created. These roles include a preestablished set of permissions that allow users to perform different tasks. A role can be assigned to an individual user by business unit or to an entire business unit (and every user in that business unit inherits the role).

There are two types of standard Marketing Cloud Engagement roles: roles specific to Email Studio and roles for other Marketing Cloud Engagement apps (such as Journey Builder). Here’s a tip: Any roles that don’t include the phrase Marketing Cloud Engagement are specific to Email Studio.

Let’s review.

Role	Description
Administrator	Assigned to the account admin to have full access to Email Studio features.
Analyst	Assigned to a user who only needs access to Email Studio tracking features for reporting purposes.
Content Creator	Assigned to users building and monitoring emails in Email Studio. However, they can’t access subscriber data or admin features.
Data Manager	Assigned to users who need to only have access to subscriber data and interactions in Email Studio. They can’t view or create emails.
Marketing Cloud Engagement Administrator	Assigned to a user who manages channels, apps, and tools. They have full access to Marketing Cloud Engagement, including account configuration and user setup.
Marketing Cloud Engagement Channel Manager	Assigned to a user who creates and executes cross-channel interactive marketing campaigns and administers specific channels. They have full access to actions associated with Marketing Cloud Engagement features, but they can’t access Setup for account configuration or user management.
Marketing Cloud Engagement Security Administrator	Assigned to an IT or security user to maintain security and compliance settings and monitor user activity and alerts from the Setup menu. They have access to certain features in Setup but are restricted from other Marketing Cloud Engagement features.
Marketing Cloud Engagement Content Editor/Publisher	Assigned to a user who creates and delivers messages through applicable channel apps, like Journey Builder. However, they can’t run reports or create automations.
Marketing Cloud Engagement Viewer	Assigned to a user who can view all Marketing Cloud Engagement features, but can’t create, send, edit, or delete any activities.

If someone needs access to all areas of Marketing Cloud Engagement, be sure they have an Email Studio role and a Marketing Cloud Engagement role assigned. Also if you assign the Marketing Cloud Engagement Administrator and Administrator roles to a user, no other roles are needed because they allow full access to all permissions.

Create Custom Roles

What if the standard roles don’t quite fit your needs? As a Marketing Cloud Engagement admin, you can create custom roles that better align with a user’s job functions. First identify the standard role for that user. Then under Roles in the Setup menu of Marketing Cloud Engagement, create a new role, add a descriptive name, and adjust permissions based on the specific job they are completing.

Consider the following when adjusting permissions.

What feature or application does the user have access to now?
What feature is missing that they need to do their job?
What shouldn’t that user have access to?

Once created, you can assign users both standard and custom roles.

Need a template for managing your users? Make a copy of this Roles and Permissions Quip worksheet.

Helpful Tips

Before you begin assigning roles and adjusting permissions, follow these tips.

Provide users the minimum access needed to complete their work.
Don’t change individual permissions. Create custom roles when needed and pair them with standard roles.
Test roles before providing access to your users.
Restrict the number of users granted Administrator and/or Marketing Cloud Engagement Administrator roles.

You’re now ready to empower your users with the right roles and permissions in Marketing Cloud Engagement.

Grow your business with Salesforce Starter