Changes to Pardot Login and Salesforce Identity Licenses
You may have seen this month’s Salesforce feature retirement notice that was sent out? It notified Pardot customers of the end of life for Pardot-only Logins, February 15, 2021 (as part of the Spring ’21 release). From then on, all users logging into Pardot must use Salesforce’s single sign-on (SSO).
The announcement was followed by confusion, and the community voicing irritation at the implications this decision will have, both in monetary terms and disruption to technical architecture. This post talks about the changes to how Pardot users login, why Salesforce are making the changes, and what you need to set up by Spring ’21.
How Does Salesforce SSO Work With Pardot?
Let’s look at the evolution of Pardot login. Originally, Pardot was a standalone tool, that could be connected with Salesforce and other CRMs. Pardot users would visit pi.pardot.com, and use their Pardot credentials to login into the application, regardless of whether they had a Salesforce license, or not.
Contrast that with how it will be in Spring ’21. Users wanting to use Pardot will need to do so through Salesforce single sign-on (SSO). Using Salesforce SSO means that their user record must be tied to a Salesforce username. This is represented by a blue cloud icon on the user record, shown below:
There were a few steps in between, including Salesforce User Sync (which will be default for new accounts created in Summer ’20 and beyond). Retiring Pardot-only login will be the final step in bringing all user records onto the core Salesforce platform.
Users will still be able to use the pi.pardot.com login screen but the only option will be to ‘log in via Salesforce’:
Why Would You Need a Pardot-Only User?
- Integration users (3rd party): as user records that are used for 3rd party integrations* directly to Pardot using the Pardot API (*tools not on the Salesforce platform).
- License cost: to avoid paying for a Salesforce license for any users that only need to use Pardot functionality.
Enforcing Salesforce SSO panicked people that they would need to pay out for tons more Salesforce licenses to fill the gap for their Pardot-only users.
Pardot-only users aren’t that great. The primary downfall is that Pardot-only users don’t have access to the core Salesforce platform, which means they cannot use the Pardot Lightning App! Without access to the Pardot Lightning App (which is granted with a Sales Cloud or Service Cloud user license), users won’t be able to use the majority of new features being released now and into the future (which have the Pardot Lightning App as a pre-requisite).
Why is Salesforce Forcing the Change?
With questions bubbling up around the community, we should look at why Salesforce are making this change.
- Security: Salesforce’s user security system is robust and extensible, and is kept up to date with the latest security protocols. Also, Salesforce SSO is more sophisticated, offering more options for authentication (multi-factor authentication system) and login restrictions (login hours, login IP restrictions).
- Product strategy: as I mentioned, the majority of new features being released now and into the future have the Pardot Lightning App as a pre-requisite (Business Units, Lightning Email Builder, Engagement History). Users will miss out on these, and Salesforce want to avoid users being stuck with a legacy product.
- Commercial objectives: although a Sales/Service Cloud license isn’t required to use Pardot, it’s required to access the Pardot Lightning App.
…I do believe Salesforce when they say that security and innovation are the driving factors behind the change. This can be backed up when looking at Salesforce Identity Licenses.
What is a Salesforce Identity License?
A Salesforce Identity License is designed to create a user record in Salesforce with the sole purpose of enabling single sign on (SSO). These Salesforce user records won’t have any functionality in Salesforce, but will have their original functionality in Pardot.
The Pardot team are determined not to leave anyone in the lurch, and they will be bundling enough Salesforce Identity Licenses for a typical Pardot account. The Salesforce Identity Licenses included per org will be capped – the exact number is not confirmed, however, additional licenses will cost $5 each.
This is a great move by Pardot, not forcing all customers to buy into Sales/Service Cloud licenses to bridge the gap for Pardot-only users. The setup effort involved will be to set up a Salesforce user record using the Salesforce Identity Licenses (which will be put into your org late 2020), and connect Pardot-only user records to these new Salesforce users.
The Pardot team ran the numbers on their customer base, and believe 99.9% of customers won’t be faced with a price increase.
So, maybe it’s not so bad, after all?*
(*if you don’t have APIs to reauthenticate, that is)
Read the full details in the Salesforce knowledge base article.