{"id":19594,"date":"2024-01-30T03:22:00","date_gmt":"2024-01-29T21:52:00","guid":{"rendered":"https:\/\/email.uplers.com\/blog\/?p=19594"},"modified":"2026-02-09T11:39:50","modified_gmt":"2026-02-09T06:09:50","slug":"5-tips-for-keeping-salesforce-marketing-cloud-secure","status":"publish","type":"post","link":"https:\/\/email.uplers.com\/blog\/5-tips-for-keeping-salesforce-marketing-cloud-secure\/","title":{"rendered":"11 Proven Ways to Ensure Bulletproof Security for Salesforce Marketing Cloud"},"content":{"rendered":"\n

Cybercrime is expected to cost the global economy a jaw-dropping $9.5 trillion USD<\/a> this year. To narrow it down to Salesforce, it\u2019s critical to realize that if misconfigured, more than 150,000 Salesforce-reliant companies, including yours, would be in jeopardy. <\/p>\n\n\n\n

In this blog post, we will look at some proven, Salesforce-recommended solutions to guard against potential data leaks. As Marketing Cloud experts<\/a> ourselves, we know the inside track. So, without any further ado, let\u2019s get started!<\/p>\n\n\n\n

1. Apply Salesforce-recommended Security Settings<\/h2>\n\n\n\n

To begin with, it is important that you follow Salesforce\u2019s security guidelines. Avoid relying solely on your own wisdom while setting up an account.  <\/p>\n\n\n\n

For instance, some users tend to use the same login information over the years. However, Salesforce recommends frequently resetting your login credentials. You can view the login guidelines in detail here<\/a>. <\/p>\n\n\n\n

2. Periodically Review Legitimacy of User Access<\/h2>\n\n\n\n

User management plays an important role in Salesforce security<\/a>. You need to make sure that users have \u201cthe right access to the right data at the right time.\u201d <\/p>\n\n\n\n

For instance, if someone has quit your company, they should not be able to access their Marketing Cloud account in the future. Read the full user permissions and access guide here<\/a>. <\/p>\n\n\n\n

You can also try the User Access and Permissions Assistant app, which Salesforce launched in 2022. <\/p>\n\n\n

\n
\"
Image source<\/a><\/figcaption><\/figure><\/div>\n\n\n

\u201cAnalyzing, reporting, and managing permissions will become easier for you. You no longer have to export files and do a bunch of calculations on your own to understand a user\u2019s access\u2014the User Access and Permissions Assistant will make these tasks much simpler, \u201d says<\/a> Cheryl Feldman, Product Manager at Salesforce. <\/p>\n\n\n\n

3. Apply The Principle of Least Privilege<\/h2>\n\n\n\n

Salesforce recommends all admins apply the principle of least privilege, which means granting users only the minimum privilege they need to get their job done. It is a very useful principle for curbing unauthorized access and mitigating security risks. <\/p>\n\n\n

\n
\"Principle
Image Source<\/a><\/figcaption><\/figure><\/div>\n\n\n

\u201cA user only has access to specific things (applications, services, etc.) through a predefined pathway, thus preventing a hacker from doing a lot of damage in the event they are even able to gain access to the network,\u201d explains<\/a> Laura Pelky, Senior Manager at Security Customer Management, Salesforce. <\/p>\n\n\n\n

4. Disable The API User Checkbox<\/h2>\n\n\n\n

Unless you are an integration user, you don\u2019t need to enable the API User checkbox in the setup process. <\/p>\n\n\n\n

We mentioned how important it is to reset login credentials from time to time. However, passwords for API users do not expire. Therefore, we recommend using the OAuth protocol as it provides a more secure authentication flow. You can read more about how to implement authorization to grant safe access to REST API resources here<\/a>. <\/p>\n\n\n\n

5. Prevent API Credential Exposure<\/h2>\n\n\n\n

In order for your API integration to access Marketing Cloud, you need to assign it \u201cscopes\u201d in Installed Packages<\/a>. Now, what is a scope? A scope may be defined as a library of permissions and behaviors in the Marketing Cloud. <\/p>\n\n\n\n

Instead of enabling all options<\/a> in the scope, you want to choose a select few according to the level of authorized access available. Why? Because in the event of a potential credential exposure, bad actors can perform any user action without having to log in to Salesforce. Beyond in-org controls, teams should continuously inventory external-facing assets, shadow subdomains, and cloud misconfigurations. This attack surface management guide<\/a> compares\u00a0leading tools for discovery, monitoring, and remediation in 2026, helping you select a solution to spot exposed credentials and risky services before attackers\u00a0do.<\/p>\n\n\n\n

Equally, you need to consider where and how you store your API credentials. Feel free to learn more about credential exposure right here<\/a>. <\/p>\n\n\n\n

6. Utilize Salesforce\u2019s Native Health Check Feature<\/h2>\n\n\n\n

Health Check is a free tool that enables Salesforce admins to review the security status of their organization. This feature provides a very comprehensive view of your org security. <\/p>\n\n\n\n

Health Check has a native security baseline called the Salesforce Baseline Standard. You can also add up to five custom standards if the native baseline does not align with the peculiar needs of your business. <\/p>\n\n\n

\n
\"Native
Image Source<\/a><\/figcaption><\/figure><\/div>\n\n\n

To give an instance of how Health Check identifies risks: imagine you changed the length of your password and made it shorter than the recommended length. The tool will list this setting as a potential risk since length is the most critical aspect of a good password. To make remediation actionable, equip your team with a password generation tool<\/a> that produces long, random, policy\u2011compliant passwords (custom length, mixed character sets, and no look\u2011alikes) for user, API, and integration accounts, simplifying resets while strengthening org security.<\/p>\n\n\n

\"Salesforce\"<\/a><\/div><\/div>\n\n\n\n

7. Use Salesforce Authenticator<\/h2>\n\n\n\n

Salesforce Authenticator is a mobile two-factor authentication app. It\u2019s a simple, highly effective security solution for businesses whereby employees can approve\/deny logins with a single tap on their mobile devices. <\/p>\n\n\n\r\n

\r\n
\r\n \t\t
\r\n\t \t\t\t
\r\n\t\t
\r\n\t\t \t\t\t <\/div>\r\n\t\t \t\t\t
\r\n\t\t\t \t\t\t\t\t
\r\n\t\t\t\t \t
<\/div>\r\n\t\t\t\t <\/div>\r\n\t\t\t \t\t\t
\r\n\t\t\t
\r\n\t\t\t
<\/span><\/span><\/span><\/div>\r\n\t\t\t \t\t\t
\r\n\t\t\t \"Salesforce\r\n\t\t\t <\/div>\r\n\t\t\t \t\t\t <\/div>\r\n\t\t\t <\/div>\r\n\t\t\t
\r\n\t\t\t \t

Image Source<\/p>\n\t\t\t <\/div>\r\n\t\t\t <\/div>\r\n\t\t\t \t\t <\/div>\r\n\t\t \t <\/div>\r\n\t <\/div>\r\n<\/section>\r\n\r\n\n\n\n

You can also use Lightning Login to access your account without needing to type your password. You just need to enter your username and approve the login with Salesforce Authenticator and your thumbprint. <\/p>\n\n\n\n

Lightning Login eliminates the need to remember passwords, which are often the weakest bolts in the security apparatus. <\/p>\n\n\n\n

8. Enable Multi-Factor Authentication<\/h2>\n\n\n\n

Multi-factor authentication (MFA) provides an \u201cextra layer of protection\u201d against security breaches such as credential stuffing, phishing, and even account takeovers. <\/p>\n\n\n\n

At its simplest, \u201cmulti-factor\u201d means that any potential attacker needs to overcome multiple obstacles to enter the Salesforce ecosystem. <\/p>\n\n\n\n

So it\u2019s no longer just about the username and password, which attackers can quickly breach. Salesforce has provided a detailed multi-factor authentication guide<\/a> for admins where you can learn more about how to implement MFA in Salesforce. <\/p>\n\n\n\n

\"Multi-Factor
Image Source<\/a><\/figcaption><\/figure>\n\n\n\n

9. Establish A Secure Connection<\/h2>\n\n\n\n

Salesforce recommends using a virtual private network (VPN<\/a>) to enhance the security of your internet connection. Alternatively, you can also enable encryption by using a router\u2019s administrator console. Follow these steps to access a router as an administrator:<\/p>\n\n\n\n