A Pardot Consultant’s Tips: How to Prepare for the SSO Update

This blog was written before Pardot was renamed to Marketing Cloud Account Engagement. You can read more about the name change and what it means here.

In case you haven’t heard by now, as of February 15th 2021, all Pardot users will need to sign in via Salesforce single sign-on. Users without a Salesforce License nor an Identity License, they will lose their access to be able to sign in to pi.pardot.com. 

This is a bit of a curveball update that has administrators scrambling to understand what exactly they need to do to ensure their team doesn’t lose access.

For listeners of the Pardot Life Hacks podcast with host Christina Anderson, the actions we should be taking were revealed in an interview with guest Tom Ryan; an expert Pardot consultant and Managing Director of MarCloud Consulting.

During the 40-minute episode, How to Prepare for the SSO Update #34’, Tom filled the Pardot community in on their license options, which include:

• Salesforce Licenses - access to all Salesforce features, including the Pardot Lightning App and new features like the Drag-and-Drop Email Builder.
• Identity Licenses - limited access to pi.pardot.com and intended for those who don’t create Campaigns, like freelancers, agencies and contractors.
• Platform Licenses - required for access to Pardot, all organisations using the software will have a Platform License. 

Salesforce Licenses

Generally, for your core marketing team, Salesforce Licenses are what you should be investing in. 

Some organisations may have Pardot-only users right now and this means they have limited access to Salesforce features, like the Pardot Lightning App. It also means they are reliant on Salesforce administrators to take care of tech integrations between the two platforms. 

Tom argues that Pardot users should have access to both platforms because much of the Pardot implementation actually requires Salesforce features. 

Like marketing and sales, Pardot and Salesforce are becoming much more aligned. It’s looking as though the two platforms will increasingly be more integrated, so if the majority of your team do not have Salesforce Licenses, you could find this more challenging in the future.

Salesforce Licenses give your team full access to Pardot and Salesforce.

Identity Licenses

Identity Licenses are best for those who use the platforms rarely or almost need more of a view’ access, like your third-party contractors, agencies and freelancers.

They create a user record in Salesforce but only for the purposes of single-sign-on.

In light of the upcoming SSO update, Salesforce has actually granted 100 Identity Licenses to customers to allows for any who don’t currently have Salesforce Licenses.

Those users with an Identity License will be unable to create Campaigns nor use most of the more recent Pardot features, nor those coming in the future.

Tips for setting up Identity Licenses

1. Create different profiles
2. Align profiles with your Pardot roles

For example, one profile could be called Identity - Administrator’ and another Identity - Marketing’. This makes it very easy to map your profiles across when you have User Sync turned on and ensures the right level of access is given to the right users, especially for global organisations working with lots of partners.

Classic Pardot vs Lightning

Teams using the classic version of Pardot, may not feel ready to take the leap to Lightning. Yet, Lightning is considered pretty much the basic’ level that’s required for rolling out modern marketing tactics and being able to track and report on these.

The benefits of Lightning include:

• B2B Marketing Analytics
• Campaign Influence
• Engagement History
• And more!

In Tom’s opinion, everyone should move over to Lightning sooner rather than later because it’s an inevitable change and eventually, Classic will become redundant.

Nevertheless, we’re not living in an ideal world and budget and other factors can restrict businesses from being able to jump headfirst into Lightning for the whole team. 

In this case, consider a hybrid approach instead. 

If one or two of your Pardot admin users are moved over to Lightning and given Salesforce licenses, the rest of the team can stay on Identity Licenses with limited access.

All this being said, what steps should you take to prepare correctly?

Getting prepared

For single-sign-on only, Pardot admins should:

1. View all of your Pardot users and identity who actually needs access by decluttering old users.
2. Export your Pardot users and Salesforce users into Excel spreadsheets for a visual look at who is linked in both platforms.
3. Once you have the gaps, buy Identity Licenses for those who need them.

If you’re happy to stay at a single-sign-on level only, that’s everything you need to do to retain user access post-February 15th.

However, Tom suggests going a step further…

To enable User Sync:

1. Have a look at your Profiles in Salesforce.
2. If your Profiles look good, turn on User Sync to better align the two platforms. When a user is deactivated in Salesforce they will automatically be put in the Pardot Recycle Bin too.

After this, you do have the option of going one step further and setting up Managed Users in Salesforce, then setting all of your permissions for various users from there.

With your user access complete, you now need to consider third-party platform access.

Third-party platform API access 

One of the questions circulating is how the single-sign-on update will affect third-party access via API.

As Tom puts it in the podcast, what previously was Pardot authentication, will now become Salesforce authentication. For this reason, all of our integrations will need to be reviewed.

For tools like Zapier, for example. We’ll need to create an account with our Salesforce credentials and integrate this way, rather than using our Pardot details.

There are two ways to do this:

1. Create a single Salesforce user and connect this way.
2. Set up a connected app in Salesforce for each third-party platform and apply the permissions for multiple users from here. Connected apps are much more scalable.

Tip: Remember to include the Business Unit ID so the integration is applied to the correct one.

The best approach is to:

• Make a list of the tools that are business-critical and focus on these as a priority.
• Check the third-party platform documentation and follow their steps if they exist.
• Set API integrations via single Salesforce user or Connected apps.

Once you’ve reviewed and updated your API integrations, and sorted your user Licenses, you’re ready for the update to hit and if all have been done correctly, there shouldn’t be any issues!

If that’s not the case and you’re tearing your hair out trying to regain access after the SSO update, feel free to send the MarCloud Consulting team a message for Pardot support.