How to Set Up Pardot Users: Identity Licenses, Pardot SSO, User Sync & Business Units

This blog was written before Pardot was renamed to Marketing Cloud Account Engagement. You can read more about the name change and what it means here.

Before we can embark on our marketing automation journey and explore exciting features, we must first set up our users. As part of the Spring’21 release, Pardot-only users will be retired from February 2021. 

To learn more about Single Sign On (SSO), Salesforce User Sync and Business Units, plus how this can be connected to Pardot, read on.

How to Set Up New Salesforce Users: SSO, User Sync and Business Units:

• Setting up a Salesforce User
• Single Sign On (SSO)
• Salesforce User Sync
• Users and the V2 connector
• So, what should I do now?

Setting up a user in Salesforce

Users in Salesforce have specific identifying details. You can set up a new user in Salesforce by heading to Setup > Users > Users (Sub menu) > New User or heading to [your_domain]/lightning/setup/ManageUsers/home.

• Username/ Email - This is unique across all platforms (Salesforce/ Pardot). The username must be formatted like an email address and can be the same but it doesn’t have to be. You can add a +1 into your email e.g. tia+1@testaccount.com.

Note: When logging in, users must update their password and the link sent to do this can only be used once.

• User Licence - Access to certain features in Salesforce is dependent on the type of User Licence given to the user.

For Pardot only users, you need to give them an Identity licence.

• Profile - There can only be one profile per user and is chosen based on the user's job functionality, as this determines the permissions for certain functionalities in Salesforce.
• Roles - The role of a user will limit what is visible in Salesforce. Generally, there is a role hierarchy, where you can assign roles to users with visibility based on their position in this hierarchy.
• Alias - An alias is a type of nickname, if you will, that will identify you as the user (it is shorthand as your entire name probably won’t fit). This is automatically assigned as the first letter of a first name and first four letters of a last name e.g tcarr.

To set up a user in Salesforce head to Setup.

1. Setup > Type in Users’ into Quick Find > Select Users
2. Depending on how many users you want to add Select New User (single) or Add Multiple Users (up to 10).
   
3. Select User Licence - this will decide the Salesforce accessibility for each user. This is where you would set up the Identity Licence.
4. Select Profile for the user.
5. Save.

Note: New users will have to be linked to a Salesforce user before they can log-in to Pardot. Enabling Salesforce User Sync automates user creation and deactivation within Salesforce AND Pardot. Click here to read more about Salesforce User Sync.

From August 2020, The identity licenses have been automatically added to current orgs and can be found under:

Salesforce Set Up | Company Information | User Licenses

As all Pardot users without a connection to a Salesforce user will lose the ability to log in, your Pardot and Salesforce orgs must be connected and have a verified Salesforce-Pardot connector in order to link users and have enabled Salesforce User Sync.

Note: Users managed with Salesforce User Sync have SSO enabled by default. Click here to jump to Salesforce User Sync.

Single Sign On (SSO)

For the time being, Pardot-only users work exclusively in Pardot, without access to Salesforce. From February 2021, Pardot-only users will be retired and therefore log in options for these users will be affected. 

So, what can we do?

If you have both a Pardot and Salesforce user seat, you can enable Single Sign On (SSO). SSO enables users to access multiple instances (Pardot and Salesforce) with a single login and one set of credentials. As a result, Pardot + Salesforce SSO users will need to stop using Pardot credentials and only use the Salesforce credentials to access the org. As a result, Pardot-only users will need to be linked to a Salesforce user and SSO enabled.

Note: Users who have not been enabled with Salesforce SSO by the Spring 21 release will not lose access to Pardot, but will lose their ability to log-in until they are linked to a Salesforce user and enable SSO. 

If you do not have a Salesforce seat, don’t fret! Salesforce has issued 100 Free Identity Only Licences so that this login option is authenticated to Pardot-users only, without an additional cost to your organisation and without the need of a Sales/Service cloud license. Salesforce Identity License creates a user record in Salesforce with the sole purpose of services such as single sign on (SSO). This will give Pardot users access to Salesforce with limited functionality, but allow their original functionality in Pardot.

If you wish, you can still provide a full Sales or Service Cloud license to your Pardot users, however, this will be for an additional cost. Therefore, we recommend utilising the identity licenses!

Salesforce User Sync

To connect Salesforce and Pardot users, you will need to enable Salesforce User Sync. Salesforce User Sync simply means that all users will be managed in Salesforce and all records in Salesforce and Pardot will be updated simultaneously and become synced’ users.

Synced users won’t be able to use Pardot credentials to log in to Pardot. Therefore, once user sync has been turned on you can access Pardot by simply signing into Salesforce with your login details and then head to pi.Pardot and click: 

Alternatively, if the user has a Salesforce Licence, you can access Pardot through the Pardot Lightning app in Salesforce. It is also important to note that when creating Salesforce features such as Campaigns, the user must have a Salesforce Licence as this is not available on an Identity Licence.

Note: Once Salesforce User Sync has been enabled, it can’t be disabled.

So, how does this work? You will need a Salesforce admin to assign Salesforce users to Pardot from Salesforce Setup, this will create them as Pardot users. After, a Pardot admin map over profiles and enable Salesforce User Sync or similarly, grant Salesforce control over user management.

As a result, the Salesforce user record becomes the master by default, with Pardot records syncing to match this.

Users and the V2 connector

When upgrading from the V1 to V2 connector, we are now able to use an integration user’. This user profile is made with permissions to integrate Pardot and Salesforce with no risk of breaking the connection between the two instances if changes are made to the connector user (a possible scenario when using the V1 connector) with the additional benefit of not using a dedicated Salesforce licence!

If you would like to learn more about the Ins and Outs of Pardot and Salesforce Integration, read this blog.

Depending on the size of your organisation, you may have multiple divisions focused on specific marketing objectives. It may be cluttered and you may be pulling out your hair thinking, well how can we organise this to be more efficient?

The answer is Pardot Business Units.

It is key to note that this useful feature is only accessible to Pardot Advanced and Premium Editions through the Pardot Lightning App.

To check your edition, head to Pardot > Account Settings.

Users will only have visibility to the Pardot data in the business unit that they are related to. However, in Salesforce it is the permissions that determine which data is available for users as Pardot and Salesforce have their own data authorisation.

In simpler terms, a user may have Salesforce access to all leads in Salesforce, but limited access to prospects in one business unit. Determining who will have access is done when assigning a Profile and configuring Salesforce User Sync. Based on the user’s Salesforce Profile, the Pardot Admin uses Salesforce User Sync to choose which users are synced to a business unit.

Note: You will not be able to manage manually created users in Pardot with Salesforce User Sync.

It is also important to note that some users may have the same Salesforce profile, yet need to be assigned different business units. To work around this issue, the Pardot Admin will need to create custom profiles with specific permissions to assign individuals. Once this is done, Salesforce User Sync can be configured in each respective business unit.

To learn more, we’ve written a post entirely on this feature: Pardot Business Units: What You Need to Know.

So, what should I do now?

• Find users who will need to make the switch to Salesforce SSO before February 2021:

1. Enable SSO for any Pardot users who have a Salesforce log-in.
2. Set up an Identity licence for all Pardot-only users. On the users list view use the View filter to show all Pardot-only users. If you have Salesforce User Sync enabled, this list will be the only list of users affected. If you don’t have Salesforce User Sync enabled, this list will be of Pardot + Salesforce SSO users. 

• Audit users, check who can be archived if not active.
• If you are not already utilising User Sync, consider enabling it.

We hope this blog has provided you with insight into adding and managing Salesforce and Pardot users through Single Sign On (SSO) and Salesforce User Sync. Please contact us if you are having any trouble with setting this up!