* Marketing Cloud Engagement *

*** Important Security Update: Enforcement of IP Allowlisting in Marketing Cloud Engagement on September 23, 2026 ***As part of our commitment to strengthening the default security of the Marketing Cloud Engagement platform, Salesforce is requiring the use of the login IP allowlist in blocking mode for all accounts. We have identified that your instance doesn't use the login IP allowlist in blocking mode. On September 23, 2026, we will enable it on your behalf.

Next Steps & Timeline

To help minimize potential disruption, we reviewed your recent login activity and compiled a list of recommended baseline IP addresses to include on your login IP allowlist. On September 23, 2026, we will enable blocking mode for your instance. After this date, users can log in to your Marketing Cloud Engagement account from an IP address on the allowlist.

Configuration Impact and Customer Responsibility

No action is required before September 23, 2026. To ensure your configuration is applied correctly, we recommend waiting until after September 23, 2026, before making any changes to your login IP allowlist settings. If you have any concerns, contact Salesforce Support.

After September 23, 2026, you are responsible for reviewing and maintaining your login IP allowlist. Monitor your login IP allowlist access logs on an ongoing basis to identify new IP ranges to add.  See View the Access Log, Add IP Addresses to the Allowlist, and Edit an IP Range.

When we enable blocking mode in your account, you can expect these changes:

• We will apply a Salesforce-recommended baseline IP list consisting of standard /24 (256 address) IP ranges. These ranges are based on IPs observed to successfully authenticate to your instance over the last six months, excluding known malicious IPs.
• "Log Violations and Deny Access" (blocking) mode will be enabled at the EID level for both UI Login and API access, with the IP ranges uniformly applied to all Business Units (BUs).

Resources

• Mandatory IP Allowlisting in Marketing Cloud Engagement
• View the Access Log
• Enable the Login IP Allowlist
• Add IP Addresses to the Allowlist
• Edit an IP Range

#Marketing Cloud Engagement #Marketing Cloud

📬 Marketing Cloud Next takes care of your sending IPs automatically. But that doesn't mean you're off the hook for deliverability: https://mateuszdabrowski.pl/docs/salesforce/marketing-cloud/config/ip-warming-deliverability/

On @* Marketing Cloud Engagement * you have full control over deliverability, for good and for bad. On @* Marketing Cloud Growth & Advanced * the experience is more streamlined, but also controlled by Salesforce. You start on a shared pool of IPs, and you work your way out of it. 

Once you cross ~5M emails/type/month, Salesforce rewards your achievement with a dedicated IP, and warms it on its own. Not much to do for you. No schedule, no throttling, no configuration. Marketing Ops dream? Almost. 

There are still some important tasks on you: 

🔵 You still need basic configuration to enable your first sends. And it's a bit stricter than it was on MCE. 

🟠 IP reputation != Domain reputation.  A new sending domain (might) still need its own warming plan. 

🔴 Monitoring is a must. It already was. Then it got must-er with tighter ESP bounce & complaint rate requirements. And now it is must-est with lower control over IPs and the impact of being demoted to the Gray Pool.  

Full mechanics, the prerequisites checklist, and the monitoring options with setup guides are available now on my page.

🧱 It's time for MC Next Business Units Architecture! 

TL;DR: Default to a single BU until a hard requirement forces the split: 

https://mateuszdabrowski.pl/docs/salesforce/marketing-cloud/config/business-units/

The decision tree in the article has an "Are you sure?" step for a reason... New Business Units work differently to what you know from the good old @* Marketing Cloud Engagement *

On @* Marketing Cloud Growth & Advanced * a Business Unit is a thin marketing layer over exactly one Data 360 Data Space. The Data Space is the real wall - no hierarchy, no per-BU login, everything you can access in one view, with a badge telling you where you are. 

Three things to know before you click create: 

🔵 It's forever. A Business Unit can't be deleted, deactivation is permanent, and the Data Space it consumed can never serve another one. You get 2 included with Advanced Edition, and can pay your way up to 150 total since Summer '26. 

🟠 Splitting splits everything (duh!). Segments, flows, content and reporting all partition with the Data Space - cross-BU reuse means deployed copies (Data Kits, Common Assets), multiplied processing, and no consent sync! 

🔴 Governance has one blind spot for the recommended Single BU approach. Data 360 row-level visibility control holds almost everywhere - except segment and Calculated Insight runs. Region filters on segments stay manual. 

In the article, you will find a trade-off matrix (Data, Segments, Consent, Domains, Licensing, and more), architecture patterns, and the Global BU duplication tax.

***POLL IS CLOSED***

Lantern Astro won across every poll and will be the Winter ’27 Release logo!

_________ 

Help us choose the official Salesforce Winter ’27 Release logo.

Which character should star?

1️⃣ Agent Astro

2️⃣ Bookish Codey

3️⃣ Agent Appy

4️⃣ Lantern Astro

Cast your vote here, or vote in our polls on X, Instagram and LinkedIn (or all four!). 

🗳️ Voting closes Friday, July 10. The character with the most votes will become the official Salesforce Winter ’27 Release logo.