• Carl

Getting your head around Marketing Cloud roles



When it comes to setting up your Marketing Cloud account, one of the things that might confuse you is which role to select for each user. What might confuse you further is why there is a Marketing Cloud Administrator role and an Administrator role!


Aren't they the same thing?


It was certainly something that left me scratching my head. Fear not though, this blog post should have you covered!


Why are there so many roles?



Out of the box, you'll have 10 roles to choose from. It's important to get this right as you don't want just anyone being able to alter the org, export prospects or leave room for some serious human errors to occur because they were given too much access.


I found when looking at these roles that it's easier to think of the roles as two sets. An Email Studio roles and a Marketing Cloud standard roles.


Email Studio roles


The Email Studio roles are a carryover from when Salesforce acquired ExactTarget back in 2013. You can modify these roles and they are focused on access and permissions within Email Studio.


Now let's go through each role.

  • Administrator - This user has full access to be able to create, edit, delete or share content within Email Studio, as well as having general admin rights across Marketing Cloud, such as being able to to manage company settings and add new users.

  • Analyst - A user with the Analyst role will have access to email tracking and results from email sends.

  • Content Creator - This user can create content for you to use in email sends but they won't be able to access subscriber data or send emails. Bear in mind that since this role is predominantly linked to Email Studio, they won't have access to CloudPages or MobileConnect, so don't think of them as being able to create content across all channels.

  • Data Manager - This is the user that will help maintain the account data structure and subscriber records through managing lists and Data Extensions. Bear in mind that this user will be able to import and export data.

  • Distributed Sending User - I doubt you'll be using this role as it is a bit of a redundant role (truly worthy of the title legacy). It was replaced with Distributed Marketing.

Marketing Cloud standard roles


It's easier to spot these roles since they start with Marketing Cloud in the title. These roles don't cover Email Studio (the above roles have you covered there) but you are covered across the remaining suite of Marketing Cloud applications, such as Advertising Studio, Social Studio, Audience Builder, Mobile Connect and others.


These roles, unlike the Email Studio roles, cannot be modified.


Here are the roles and what permissions they cover.

  • Marketing Cloud Adminsistrator - Creates users, assigns them roles and manages the remaining suite of applications within Marketing Cloud. The least restrictive role so don't be so generous with handing this role out to your users!

  • Marketing Cloud Marketing Cloud Channel Manager - A person with this role can create and deploy cross-channel marketing campaigns. They can also create and deliver messages through Mobile and Social Studio.

  • Marketing Cloud Content Editor/Publisher - Whoever has this role can create and deliver messages through mobile and social channels.

  • Marketing Cloud Security Administrator - This user will have the ability to manage security settings, as well as manage user alerts and activity.

  • Marketing Cloud Viewer - Like the analyst role in Email Studio, this user can view activity and results across the remaining channels.

Permission overlap with multiple roles


So now that we have the roles defined, it's important to make note of this fact when you begin to assign multiple roles and permissions to your users...


Marketing Cloud will go with the most restrictive role / permission.


What does this mean?


You can assign multiple roles to people. It's actually the best way to do things by assigning a standard role that's the closest to meeting the users' requirements and then assigning additional permissions on top of that (much like a Salesforce permission set).



But if you are giving users multiple roles, their level of access will be restricted to the role with the least amount of access. The extreme example is someone who has both Marketing Cloud Viewer and Administrator roles assigned to them. Because of the Viewer role being assigned, they won't be able to access a lot of the functionality, outside of seeing activity and metrics.


The best way to think of it is by considering the above screenshot across the collection of roles / permissions you've given the user.

  • If there is even one Deny checkbox ticked, they won't be able to access that feature.

  • If the Allow and Deny checkbox is blank for that feature, they won't be able to use that feature.

  • If the Allow checkbox is checked and Deny isn't, then the user can use that feature.

Hopefully, that clears that up for you! 🙂




23 views0 comments

Recent Posts

See All
Subscribe to the blog!
What topics are you interested in?

Thanks for submitting!