How to Manage User Access on Account Engagement (Pardot)

When it comes to granting or restricting access to Account Engagement (Pardot), it can get overwhelming because there are a few different (yet related) ways you can control how access is given to your users. 

If you’ve become confused about where to look first, I don’t blame you. After all, before Account Engagement moved to the core Salesforce platform, admins could easily add users directly to Account Engagement without jumping through hoops. If you’ve been tasked with administering user access to Account Engagement, here’s what you need to know.

1. All Account Engagement (Pardot) Users Need to Be Salesforce Users

After the Spring ‘21 release, Account Engagement (Pardot)-only logins were discontinued, meaning all users logging into Account Engagement must now use Salesforce single sign-on (SSO).

If your Account Engagement users are also Salesforce users with an active Salesforce license, then you’re good to go.

But, if your users only need access to Account Engagement, you could also grant access to the system by assigning your new users an identity license on Salesforce. For every Salesforce org with a Professional, Enterprise, Unlimited, and Performance Edition license, Salesforce has already provisioned 100 free identity user licenses which can be used for this very purpose.

2. Necessary Permissions Sets

To have access to Account Engagement (Pardot), users need either one of the following permission sets assigned to their user record:

• Sales Cloud User
• CRM User
• Service Cloud User
• Account Engagement User

Note: Salesforce introduced the Account Engagement User permission set to allow identity-licensed users to access the Account Engagement Lightning App in Salesforce without needing full access to Salesforce.

The permissions above are necessary to view the Lightning App.

However, you could also create your own permission sets to grant access to Account Engagement on a more granular level. If you require flexibility in the permission set assignment, you can opt not to choose a license for the permission set.

While you can use this custom permission set and enable the “Allow access to all Pardot features” app permission, the downside is that you’ll need to stay on top of releases as new permissions will not automatically be added to custom permission sets.

For users, other permissions in Setup you may want to look at are:

• Access Drag and Drop Content Builder
• Activate Email for Automation
• Manage Email Content
• Create CMS Workspaces and Channels
• Salesforce CMS
• CMS Channels
• CMS Workspaces

For your Account Engagement admins, you may also need to grant them access to the following permissions if you need them to complete any setup activity:

• View Setup and Configuration
• Manage Marketing Setup Tasks
• Manage Profiles and Permission Sets
• Assign Permission Sets

Other than that, users also need access to the B2BMA Canvas connected app. Go to Setup > Manage Connected Apps, then select the b2bma_canvas app. Here, you’d either click on Manage Profiles or Manage Permission Sets and assign the connected app accordingly. 

3. The Hidden Account Engagement Lightning App

Even if you’ve enabled Account Engagement in Setup and completed the setup process, your users may still not be able to see the Account Engagement Lightning App.

If you need them to see the app, just head over to Setup > App Menu, then click the Account Engagement App. Ensure that this reads “Visible in App Launcher” instead of “Hidden in App Launcher”.

If your users still can’t see it, it’s possible that their profile doesn’t have access to the Lightning App itself. To fix this, go to Setup > App Manager, then select the Account Engagement App (with the App Type “Lightning”).

When you go in to edit the app, you should be able to see the User Profiles tab. Here, you should select all the profiles that need access to the app.

4. Enable Salesforce User Sync

While it’s an opt-in feature for Account Engagement (Pardot) customers using Sales Cloud, there are many perks to using it, such as keeping user records in sync (sync user records in Account Engagement become read-only and inherit information from Salesforce) and easier management of users, as user access settings are now configurable from Marketing Setup in Salesforce. 

However, it’s highly recommended that before you enable User Sync, you review the User Sync Enablement Guide because once it is enabled, it cannot be disabled.

An example of a record after User Sync has been enabled.

Important: The process for User Sync setup varies depending on when your business unit was created and if you currently use the legacy version. To make sure you’re following the correct instructions, refer to the Find the right User Sync documentation.

5. A User’s Role in Account Engagement (Pardot)

A User’s Role in Account Engagement (Pardot) is ‘decided’ by their Salesforce Profile with Salesforce User Sync.

If you do proceed with enabling user sync, you’ll then be prompted to complete the configuration by defining the Salesforce Profile to Account Engagement role mapping.

This definition is crucial in defining the level of access your users would have when working within Account Engagement. You would not want to map a profile to a higher level of access than necessary (or than what users are trained to do).

Here are the four standard user roles in Account Engagement:

• Administrator
• Marketing
• Sales Manager
• Sales

The out-of-the-box user roles work for many orgs, but you may need to tweak the permissions for specific users depending on the maturity of your Salesforce usage and marketing operations.

If, for example, you have multiple users with the same Salesforce profile but need varying levels of permissions on Account Engagement, the first thing you need to check is if the standard user roles are sufficient in defining these different access levels. If it is, then you would only need to create different profiles and map them to the standard Account Engagement user roles.

However, you may end up needing custom roles to restrict or open up access to featured within Account Engagement. This feature is only only available in Advanced editions, or Plus editions at an additional cost.

When creating a custom role, you could also copy an existing role and edit the permissions accordingly.

6. Assign Users to the Account Engagement Business Unit

Users need to be assigned to the Account Engagement Business Unit in Setup, and this may override the Role <> Profile assignment.

When assigning public groups, roles, role and subordinates or users to the Account Engagement Business Unit, you’ll see two sections: 

• Marketing Users
• Sales Users

It might seem intuitive to assign all users who are in Marketing to the “Marketing Users” section and all Sales users to the “Sales Users” section, but there’s more to it.

When setting this up, if you know for a fact that your user needs very limited access to Account Engagement (Pardot), you would assign the relevant public group, role, role and subordinate or user to the “Sales Users” section, as it ensures that the user would only have the “Sales” role on Account Engagement regardless of their profile mapping. 

Otherwise, you could assign them to the “Marketing Users” section, and their Account Engagement role assignment will pay respect to the mapping that was defined with User Sync.

7. Limit a User’s Ability to Import or Export Prospect Information

If you need to further control access within Account Engagement (Pardot) on a user level, there is the option to set some limits on the number of emails that can be sent or the number of prospects that a user can import or export at any one time.

You can access this by:

1. Click on Account Engagement Settings.
2. Select “Users” under the User Management tab.
3. Select the user whose prospect limits you would like to update.
4. Click Edit User and scroll down to the Security Limits section.

Here, you can toggle the limits on or off and set a maximum limit of prospects that this user can target through these different actions. 

Summary

Whether you’re implementing Account Engagement (Pardot) for the first time or onboarding a new team member who needs access to an existing org, there are a few steps that need to be taken to ensure that your user has the necessary access to Account Engagement to perform their work.

An understanding of how these different settings work with each other will become a powerful tool you can leverage to administer Account Engagement correctly, whether you’re choosing to grant or deny them access to Account Engagement and its data.