SaaS

Salesforce Marketing Cloud

Connect Salesforce Marketing Cloud (Marketing Cloud Engagement) to Ploy to see who has access, which roles they hold, when they last signed in, and which accounts are locked or inactive. Ploy can also create users, and deactivate or reactivate them, from your workflows.

This integration is in beta

The Salesforce Marketing Cloud integration is in beta. It was built from Salesforce's API documentation and has not yet been run against a live customer account, so some behaviour may change as we confirm it.

The first step of setup is a consent checkbox. Ticking it lets Ploy record redacted error details when a call to Marketing Cloud fails, so we can fix problems quickly. Redacted means names, email addresses, tokens and other personal or secret values are removed before anything is stored. You must tick it to continue.

What Ploy reads

  • Users: every user in every business unit, including inactive ones, with their email address, username and the last time they signed in.

  • Roles: the roles each user holds.

  • Locked users: shown as unable to sign in, but still holding their seat, because an administrator can unlock them.

  • Inactive users: shown as no longer having access. Marketing Cloud cannot delete users, so deactivating is how access is removed.

  • API users: installed packages and other API logins, shown as non-human identities.

Ploy reads your users every six hours. One connection covers your whole account, including every business unit under it.

Accounts with more than 2,500 users

Marketing Cloud returns users in batches of 2,500, and it leaves roles out of every batch after the first. If your account has more than 2,500 users, Ploy still shows every user and whether they have access, but for users after the first 2,500 it cannot see their roles. When that happens, Ploy keeps the roles it has already recorded rather than removing them, so a role taken away from someone in Marketing Cloud may still show in Ploy.

What Ploy can change

  • Create a user in your top-level business unit, with the role you choose. Marketing Cloud requires every new user to have a password, so Ploy sets a random temporary one that the person must change the first time they sign in. Ploy emails it to them only if you turn on Email user password? in the workflow step. Otherwise, reset their password from Marketing Cloud's user settings so they can sign in.

  • Deactivate and reactivate users.

If your account uses single sign-on, Ploy does not set up single sign-on for the new user. After Ploy creates them, turn on single sign-on for that user in Marketing Cloud and enter their Federation ID.

Built-in roles whose names start with "Marketing Cloud" cannot be given through Marketing Cloud's API, so Ploy refuses to create a user with one of them. Choose a custom role instead, or add the built-in role in Marketing Cloud afterwards.

Ploy does not change roles on existing users. Marketing Cloud does not allow a role to be removed from a user through its API.

Before you start

You need a Marketing Cloud administrator who can create installed packages in your top-level (enterprise) business unit.

Create an installed package

  1. In Marketing Cloud, make sure you are in your top-level business unit. Ploy uses it to see users in every business unit.

  2. Open Setup, then Apps, then Installed Packages, and click New.

  3. Name it "Ploy" and save.

  4. Click Add Component, choose API Integration, then Server-to-Server.

  5. Under Users, tick Read and Write. Under Organizations, tick Read. Save.

Copy the details Ploy needs

From the API Integration component, copy:

  • the Client ID

  • the Client Secret

  • the subdomain from the Authentication Base URI. The URI looks like https://SUBDOMAIN.auth.marketingcloudapis.com/. Copy only the SUBDOMAIN part.

Also note your MID, the account number shown next to your top-level business unit's name at the top of Marketing Cloud.

Connect in Ploy

  1. In Ploy, open Integrations and choose Salesforce Marketing Cloud.

  2. Tick the beta consent box.

  3. Enter the subdomain, the MID, the Client ID and the Client Secret.

  4. Click Test connection, then Save.

Troubleshooting

  • "is not a Marketing Cloud subdomain": enter only the subdomain, without https:// or .auth.marketingcloudapis.com.

  • "rejected the client ID, client secret or MID": check all three, and check that the MID is your top-level business unit.

  • "returned no users" or "refused to list users": give the package's API integration the Users Read and Write scopes.

Was this helpful?
Was this helpful?