Hi everyone,
With the ongoing enforcement of strict Multi-Factor Authentication (MFA) and identity verification standards across Salesforce platforms (such as those outlined in Salesforce Help Article 005321561), how should teams properly configure automated service accounts or headless integrations for Salesforce Marketing Cloud Engagement?
- Given these evolving compliance and security enforcement guidelines, what is currently considered the best practice approach for non-interactive service/integration accounts in SFMC?
- Are Server-to-Server (Client Credentials / JWT) flows via Installed Packages completely immune to these UI-based MFA/identity verification restrictions, or are there additional security configurations (like API-only user mappings or specific Connected App OAuth policies) we need to adopt to avoid pipeline disruptions?
Thanks!
Yes, server-to-server Installed Packages are the recommended pattern for headless integrations and they are not subject to the interactive MFA prompts, since they authenticate with OAuth client credentials instead of a username and password. Give each integration its own installed package with only the scopes it needs, and store and rotate the client secrets securely. One thing to watch: keep an eye on the token endpoint responses in your pipelines, because an expired or revoked package shows up as an auth error, not an MFA prompt, and that is what usually breaks pipelines.
