Assign Marketing Cloud Roles and Permissions
Learning Objectives
After completing this unit, you’ll be able to:
- Define options for permissions.
- Identify standard Marketing Cloud roles.
- Consider custom roles.
Marketing Cloud User Management
User creation and management are key tasks for a Marketing Cloud admin. Once a user is created, a role is assigned to allow access to features and actions they need to complete their work. This module reviews Marketing Cloud user roles and associated permissions to help you complete this task.
Check out the Marketing Cloud Setup module to learn more about Marketing Cloud admin responsibilities.
Role-Based Permissions
Roles are established to define a user’s permissions within Marketing Cloud. A permission is a granular way of controlling access to a specific object and actions within a feature or application. For example, a permission can restrict a user from deleting a data extension in Email Studio. In other words, the permission controls access to three things.
- Object: Data Extension
- Action: Deletion
- Application: Email Studio
To mitigate risk and protect account security, deny access takes priority over allow access. When assigning permissions, use the Principle of Least Privilege. This means you assign only the access a user needs to do their job, and nothing more. There are three options for granular permissions.
- Allow: The user can see and take action on that permission (like delete a data extension).
- Deny: The user does not have permission to see a button or do an action (like deletion).
- Not Specified: The user may see the button, but no action can be taken.
Marketing Cloud Roles
Since Marketing Cloud has many available permissions, standard roles have been created. These roles include a preestablished set of permissions that allow users to perform different tasks. A role can be assigned to an individual user by business unit or to an entire business unit (and every user in that business unit inherits the role).
There are two types of standard Marketing Cloud roles: roles specific to Email Studio and roles for other Marketing Cloud apps (such as Journey Builder). Here’s a tip: Any roles that don’t include the phrase Marketing Cloud are specific to Email Studio.
Let’s review.
| Role |
Description |
|---|---|
|
Administrator |
Assigned to the account admin to have full access to Email Studio features. |
|
Analyst |
Assigned to a user who only needs access to Email Studio tracking features for reporting purposes. |
|
Content Creator |
Assigned to users building and monitoring emails in Email Studio. However, they can’t access subscriber data or admin features. |
|
Data Manager |
Assigned to users who need to only have access to subscriber data and interactions in Email Studio. They can’t view or create emails. |
|
Marketing Cloud Administrator |
Assigned to a user who manages channels, apps, and tools. They have full access to Marketing Cloud, including account configuration and user setup. |
|
Marketing Cloud Channel Manager |
Assigned to a user who creates and executes cross-channel interactive marketing campaigns and administers specific channels. They have full access to actions associated with Marketing Cloud features, but they can’t access Setup for account configuration or user management. |
|
Marketing Cloud Security Administrator |
Assigned to an IT or security user to maintain security and compliance settings and monitor user activity and alerts from the Setup menu. They have access to certain features in Setup but are restricted from other Marketing Cloud features. |
|
Marketing Cloud Content Editor/Publisher |
Assigned to a user who creates and delivers messages through applicable channel apps, like Journey Builder. However, they can’t run reports or create automations. |
|
Marketing Cloud Viewer |
Assigned to a user who can view all Marketing Cloud features, but can’t create, send, edit, or delete any activities. |
If someone needs access to all areas of Marketing Cloud, be sure they have an Email Studio role and a Marketing Cloud role assigned. Also if you assign the Marketing Cloud Administrator and Administrator roles to a user, no other roles are needed because they allow full access to all permissions.
Create Custom Roles
What if the standard roles don’t quite fit your needs? As a Marketing Cloud admin, you can create custom roles that better align with a user’s job functions. First identify the standard role for that user. Then under Roles in the Setup menu of Marketing Cloud, create a new role, add a descriptive name, and adjust permissions based on the specific job they are completing.
Consider the following when adjusting permissions.
- What feature or application does the user have access to now?
- What feature is missing that they need to do their job?
- What shouldn’t that user have access to?
Once created, you can assign users both standard and custom roles.
Need a template for managing your users? Make a copy of this Roles and Permissions Quip worksheet.
Helpful Tips
Before you begin assigning roles and adjusting permissions, follow these tips.
- Provide users the minimum access needed to complete their work.
- Don’t change individual permissions. Create custom roles when needed and pair them with standard roles.
- Test roles before providing access to your users.
- Restrict the number of users granted Administrator and/or Marketing Cloud Administrator roles.
You’re now ready to empower your users with the right roles and permissions in Marketing Cloud.
