I'm reviewing and trying to be prepared for the security roadmap enforcement dates. We have a Marketing Cloud integration that was set up in 2021 by (with) an integration partner and a Salesforce Senior Manager (Solution Architect). We have a dedicated license for the integration user, and it's set up as a System Admin at their direction. From what I understand, API-only is not an option for MC Connector integration. There hasn't been a UI login for that user since 2021 when it was created. It is not set up for MFA (not specifically exempted at this time, also not actively required either). I'm trying to figure out whether the new requirements are going to break that integration when the mandatory enforcement begins. I'd rather not touch it unless I have no choice - disruptions during our peak busy season are extremely unpopular. Could use some clear, specific guidance. Thank you!
#MFA #Marketing Cloud
Based on Salesforce official documentation, I would separate this into two topics:
- MFA is required for human or interactive logins. Marketing Cloud Engagement documentation states that MFA is required for users accessing the platform directly.
- Salesforce also documents that MFA isn’t required for system integration login types via API. However, if an admin or anyone else logs in interactively as that integration user, MFA is required for that login.
For Marketing Cloud Connect specifically, the Salesforce Integration User License / API Only System Integrations profile is not compatible with Marketing Cloud Connect, according to Salesforce documentation. So the “API-only user” approach is not the right path for this connector.
My interpretation is: if the user is only being used by the Marketing Cloud Connect integration/API flow and no one logs in interactively with it, MFA should not break the API integration based on the current documentation. But because the user is a System Administrator, and Salesforce is enforcing stronger MFA requirements for privileged users, I would confirm this with Salesforce Support before the enforcement date and make sure MFA is registered in case the user ever needs an interactive login for maintenance, reconnecting, or refreshing credentials.
https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa.htm&type=5
