Learn Administration Basics
Learning Objectives
After completing this unit, you’ll be able to:
- Explain types of Marketing Cloud Engagement tenants.
- Describe what a business unit is.
- Identify what you can configure in Marketing Cloud Engagement Administration.
- Allowlist IP addresses for Marketing Cloud Engagement.
As a Marketing Cloud Engagement developer, you may or may not have admin access to a Marketing Cloud Engagement account, but it helps to know how Marketing Cloud Engagement is structured as you’re developing custom solutions. In this unit, we explore some admin concepts, starting from the top level of an account down to specific user permissions. Let’s take a look at Marketing Cloud Engagement account administration.
Tenants, MIDs, and Endpoints
Marketing Cloud Engagement is an any-size business solution. Whether your company is a team of 10 or a team of 10,000 in 10 countries, you can use Marketing Cloud Engagement in a way that fits your company’s needs. The Marketing Cloud Engagement edition your company purchases dictates the type of tenant you’re working with. A tenant represents your top-level Enterprise account and its business units, your Core account, your top-level Agency account, or your Client account, depending on your tenant type.
| Tenant Type |
Description |
|---|---|
| Enterprise 2.0 |
A tenant is the top-level account and all associated business units. |
| Enterprise |
A tenant is the top-level account and all associated On-Your-Behalf or Lock & Publish business units. |
| Core |
A tenant is a single account. |
| Agency |
Each top-level account and each associated client account is a separate tenant. |
A unique Member Identification Code, or MID, is assigned to every account (whether it’s Core, Enterprise or Agency) and any associated child accounts. The MID value is used to identify that entity. So, depending on your Marketing Cloud Engagement edition, tenants can include single or multiple MIDs.
- An Enterprise 2.0 tenant includes multiple MIDs for Enterprise-edition accounts.
- An Enterprise tenant includes multiple MIDs.
- A Core tenant includes a single top-level account with one MID.
- An Agency tenant includes only the top-level account. Each associated client account unit is a separate tenant.
The tenant is important because you must reference the tenant’s subdomain to make API requests. We’ll show you how to access that information later in this unit.
If you’re working with APIs, you’ll also need to know the MID of the Marketing Cloud Engagement account you’re working with. There are a couple of ways to locate the MID after you log into Marketing Cloud Engagement.
Option 1: Hover over your account name to see the MID.
Option 2: Under your username, navigate to Setup. Under Company Settings, click Account Settings. The MID is listed as the Account ID.
Tenant Endpoints
Marketing Cloud Engagement also assigns a unique, system-generated subdomain to each of its tenants. Your subdomain is represented by a 28-character string starting with the letters "mc." When your subdomain is appended to Marketing Cloud Engagement APIs, it creates endpoints that are unique to your tenant. Only your tenant can use your endpoints. No other Marketing Cloud Engagement customer can use them for their API requests.
For example, Northern Trail Outfitters’ tenant has this subdomain: mc563885gzs27c5t9-63k636ttgm
These are their endpoints:
REST API endpoint: mc563885gzs27c5t9-63k636ttgm.rest.marketingcloudapis.com
SOAP API endpoint: mc563885gzs27c5t9-63k636ttgm.soap.marketingcloudapis.com
When you create a package in Marketing Cloud Engagement to configure API requests that use an access token, you can find your tenant’s endpoints, which contain your subdomain.
- In Marketing Cloud Engagement Setup, click Installed Packages under Apps.
- Select a package. (We’ll talk more about what this is in the next unit.)
- On the Details page, find the endpoints under Components.
If you don’t have administrator permissions to the Marketing Cloud Engagement account, share these instructions with the admin to get the information you need.
Business Units
If you’re working with an Enterprise or Enterprise 2.0 tenant, you’ll encounter business units. Business units are each assigned a unique MID. Use business units to control access to information and sharing of information throughout Marketing Cloud Engagement. For example, a company with multiple divisions or brands can create a business unit for each brand, so that users within that business unit can access only their brand-specific content. You can then use user roles and permissions to control what users can do within a business unit. You can also use business units to control user access to develop API requests.
Depending on your needs, you can use API interactions to create, update, and delete business units and set or change permissions (you can also do this directly within Marketing Cloud Engagement admin). To manage business units, you can use API requests to build your own user interface or integrate existing software with Marketing Cloud Engagement.
Accounts, User Roles, and Permissions
How an account, tenant, or business unit is actually used is determined by the account settings, user roles, and user permissions configured by the administrator.
Account Administration
Account admins control configuration information on the Account Settings workspace in Marketing Cloud Engagement Setup. Setup is divided into Account, Security, Applications, and Data Management.
- Administration: Manage roles, users, and business units. Define file transfer locations, such as external FTP sites, and manage security keys and other security options used to encrypt and decrypt data, digitally sign email messages, and implement single sign-on for your Marketing Cloud Engagement account.
- Platform Tools: Set up cross-cloud integrations and create packages for API integrations. Configure the campaigns tool, set up approvals and workflows, and configure Marketing Cloud Engagement apps.
- Settings: Find information such as the Account ID, default settings for emails, sender authentication domain, and more. Configure security settings, such as session timeouts. View the Identity Verification Access Log.
User Administration
User roles and permissions control everything from access to business units or Marketing Cloud Engagement products, such as Journey Builder or Email Studio, to what a user can do within a product, such as creating or sending a message.
Right now, we’re talking about roles and permissions for Marketing Cloud Engagement administrators and business users. Additional permissions for developers working on API requests are granted when an installed package is created for an API component. We talk about that more in a later unit.
A role is a set of permissions. Marketing Cloud Engagement includes five standard roles, but you can also create and customize roles for your account.
A permission grants a user access to something and determines what they can do with it. For example, you can grant a user permission to read something, but not create something.
When it comes to users, administrators can:
- Add users
- Modify user permissions
- Disable users
- Reset passwords
If you have administrator permissions, you can manage users in Marketing Cloud Engagement.
- Navigate to Setup (Hint: it’s under your username).
- Click Users.
- To add a user, click Create.
- To update a user, click the user and click Edit.
Check out Marketing Cloud Engagement Account User Permissions on Salesforce Help to learn more about how permissions determine the actions a user can take in Marketing Cloud Engagement.
IP Address Allowlist
Allowlisting is the process of configuring a spam filter to exempt certain email messages from being filtered or rejected. In this case, it refers to configuring your own corporate mail server so that it doesn't reject or filter the email campaigns you send via Marketing Cloud Engagement.
Your servers can interact with Marketing Cloud Engagement applications for several different reasons:
- You use Marketing Cloud Engagement API to create and send your email and SMS messages.
- You use Marketing Cloud Connect.
- You use Marketing Cloud Engagement for Microsoft Dynamics CRM integration.
To properly use the API or the integrations, allowlist Marketing Cloud Engagement server IP addresses to allow uninterrupted communication. Because server configurations are unique to each instance, apply them according to your system.
We provide a reference of IP addresses for you to allowlist depending on the type of API calls you’re making or integrations you’re setting up. Use the Allowlist reference on Salesforce Help to ensure your list of IP addresses is always current.
Now that you understand Marketing Cloud Engagement developer tools and admin basics, in the next unit we walk through the steps to set up your developer environment.
Resources
- Salesforce Help: Administration in Marketing Cloud Engagement
- Salesforce Help: Business Units in Marketing Cloud Engagement
- Salesforce Help: IP Addresses for Inclusion on Allowlists in Marketing Cloud Engagement
- Salesforce Help: Marketing Cloud Engagement Roles
- Salesforce Help: Marketing Cloud Engagement Tenant Types
- Salesforce Help: Marketing Cloud Engagement Users
- Salesforce Developer: Your Subdomain and Your Tenant's Endpoints