Learn Administration Basics

Learning Objectives

After completing this unit, you’ll be able to:

Explain types of Marketing Cloud Engagement tenants.
Describe what a business unit is.
Identify what you can configure in Marketing Cloud Engagement Administration.
Allowlist IP addresses for Marketing Cloud Engagement.

As a Marketing Cloud Engagement developer, you may or may not have admin access to a Marketing Cloud Engagement account, but it helps to know how Marketing Cloud Engagement is structured as you’re developing custom solutions. In this unit, we explore some admin concepts, starting from the top level of an account down to specific user permissions. Let’s take a look at Marketing Cloud Engagement account administration.

Tenants, MIDs, and Endpoints

Marketing Cloud Engagement is an any-size business solution. Whether your company is a team of 10 or a team of 10,000 in 10 countries, you can use Marketing Cloud Engagement in a way that fits your company’s needs. The Marketing Cloud Engagement edition your company purchases dictates the type of tenant you’re working with. A tenant represents your top-level Enterprise account and its business units, your Core account, your top-level Agency account, or your Client account, depending on your tenant type.

Tenant Type	Description
Enterprise 2.0	A tenant is the top-level account and all associated business units.
Enterprise	A tenant is the top-level account and all associated On-Your-Behalf or Lock & Publish business units.
Core	A tenant is a single account.
Agency	Each top-level account and each associated client account is a separate tenant.

A unique Member Identification Code, or MID, is assigned to every account (whether it’s Core, Enterprise or Agency) and any associated child accounts. The MID value is used to identify that entity. So, depending on your Marketing Cloud Engagement edition, tenants can include single or multiple MIDs.

An Enterprise 2.0 tenant includes multiple MIDs for Enterprise-edition accounts.
An Enterprise tenant includes multiple MIDs.
A Core tenant includes a single top-level account with one MID.
An Agency tenant includes only the top-level account. Each associated client account unit is a separate tenant.

The tenant is important because you must reference the tenant’s subdomain to make API requests. We’ll show you how to access that information later in this unit.

If you’re working with APIs, you’ll also need to know the MID of the Marketing Cloud Engagement account you’re working with. There are a couple of ways to locate the MID after you log into Marketing Cloud Engagement.

Option 1: Hover over your account name to see the MID.
The Marketing Cloud Engagement interface showing MID under the account name.

Option 2: Under your username, navigate to Setup. Under Company Settings, click Account Settings. The MID is listed as the Account ID.
The Marketing Cloud Engagement admin interface with the Account ID field highlighted.

Tenant Endpoints

Marketing Cloud Engagement also assigns a unique, system-generated subdomain to each of its tenants. Your subdomain is represented by a 28-character string starting with the letters "mc." When your subdomain is appended to Marketing Cloud Engagement APIs, it creates endpoints that are unique to your tenant. Only your tenant can use your endpoints. No other Marketing Cloud Engagement customer can use them for their API requests.

For example, Northern Trail Outfitters’ tenant has this subdomain: mc563885gzs27c5t9-63k636ttgm

These are their endpoints:

REST API endpoint: mc563885gzs27c5t9-63k636ttgm.rest.marketingcloudapis.com

SOAP API endpoint: mc563885gzs27c5t9-63k636ttgm.soap.marketingcloudapis.com

When you create a package in Marketing Cloud Engagement to configure API requests that use an access token, you can find your tenant’s endpoints, which contain your subdomain.

In Marketing Cloud Engagement Setup, click Installed Packages under Apps.
Select a package. (We’ll talk more about what this is in the next unit.)
On the Details page, find the endpoints under Components.

The Setup interface in Marketing Cloud Engagement with the Components section, including tenant endpoints, highlighted.

If you don’t have administrator permissions to the Marketing Cloud Engagement account, share these instructions with the admin to get the information you need.

Business Units

If you’re working with an Enterprise or Enterprise 2.0 tenant, you’ll encounter business units. Business units are each assigned a unique MID. Use business units to control access to information and sharing of information throughout Marketing Cloud Engagement. For example, a company with multiple divisions or brands can create a business unit for each brand, so that users within that business unit can access only their brand-specific content. You can then use user roles and permissions to control what users can do within a business unit. You can also use business units to control user access to develop API requests.

Depending on your needs, you can use API interactions to create, update, and delete business units and set or change permissions (you can also do this directly within Marketing Cloud Engagement admin). To manage business units, you can use API requests to build your own user interface or integrate existing software with Marketing Cloud Engagement.

Accounts, User Roles, and Permissions

How an account, tenant, or business unit is actually used is determined by the account settings, user roles, and user permissions configured by the administrator.

Account Administration

Account admins control configuration information on the Account Settings workspace in Marketing Cloud Engagement Setup. Setup is divided into Account, Security, Applications, and Data Management.

The navigation menu and interface for Marketing Cloud Engagement Setup.

Administration: Manage roles, users, and business units. Define file transfer locations, such as external FTP sites, and manage security keys and other security options used to encrypt and decrypt data, digitally sign email messages, and implement single sign-on for your Marketing Cloud Engagement account.
Platform Tools: Set up cross-cloud integrations and create packages for API integrations. Configure the campaigns tool, set up approvals and workflows, and configure Marketing Cloud Engagement apps.
Settings: Find information such as the Account ID, default settings for emails, sender authentication domain, and more. Configure security settings, such as session timeouts. View the Identity Verification Access Log.

User Administration

User roles and permissions control everything from access to business units or Marketing Cloud Engagement products, such as Journey Builder or Email Studio, to what a user can do within a product, such as creating or sending a message.

Right now, we’re talking about roles and permissions for Marketing Cloud Engagement administrators and business users. Additional permissions for developers working on API requests are granted when an installed package is created for an API component. We talk about that more in a later unit.

A role is a set of permissions. Marketing Cloud Engagement includes five standard roles, but you can also create and customize roles for your account.

A permission grants a user access to something and determines what they can do with it. For example, you can grant a user permission to read something, but not create something.

When it comes to users, administrators can:

Add users
Modify user permissions
Disable users
Reset passwords

If you have administrator permissions, you can manage users in Marketing Cloud Engagement.

Navigate to Setup (Hint: it’s under your username).
Click Users.
To add a user, click Create.
To update a user, click the user and click Edit.

Check out Marketing Cloud Engagement Account User Permissions on Salesforce Help to learn more about how permissions determine the actions a user can take in Marketing Cloud Engagement.

IP Address Allowlist

Allowlisting is the process of configuring a spam filter to exempt certain email messages from being filtered or rejected. In this case, it refers to configuring your own corporate mail server so that it doesn't reject or filter the email campaigns you send via Marketing Cloud Engagement.

Your servers can interact with Marketing Cloud Engagement applications for several different reasons:

You use Marketing Cloud Engagement API to create and send your email and SMS messages.
You use Marketing Cloud Connect.
You use Marketing Cloud Engagement for Microsoft Dynamics CRM integration.

To properly use the API or the integrations, allowlist Marketing Cloud Engagement server IP addresses to allow uninterrupted communication. Because server configurations are unique to each instance, apply them according to your system.

We provide a reference of IP addresses for you to allowlist depending on the type of API calls you’re making or integrations you’re setting up. Use the Allowlist reference on Salesforce Help to ensure your list of IP addresses is always current.

Now that you understand Marketing Cloud Engagement developer tools and admin basics, in the next unit we walk through the steps to set up your developer environment.