SfSkills Domains Docs GitHub

Home / admin / mcae-pardot-setup

mcae-pardot-setup

Use this skill when configuring a new or existing Marketing Cloud Account Engagement (MCAE, formerly Pardot) business unit: Salesforce v2 connector activation, connector user permissions, Salesforce User Sync, prospect field sync rules, tracking domain setup, and Account Engagement Lightning App installation. NOT for connecting Marketing Cloud Engagement (email studio, journeys) to Salesforce - use admin/marketing-cloud-connect. NOT for calling the Account Engagement REST API from code - use apex/mcae-pardot-api.

Open the skill folder on GitHub

MCAE (Pardot) Setup

This skill activates when a practitioner needs to configure a Marketing Cloud Account Engagement business unit from initial provisioning through a fully functioning bidirectional sync with Salesforce — including connector activation, connector user permissions, Salesforce User Sync, prospect field sync rules, campaign connector, and tracking domain setup. It does not cover Marketing Cloud Engagement (the email-studio product), Einstein predictive features, or Pardot API integrations.

Before Starting

Gather this context before working on anything in this domain:

Core Concepts

Salesforce v2 Connector and Its Paused Default State

When Salesforce provisions a new MCAE business unit, it auto-creates a Salesforce v2 connector record in that BU. This connector is deliberately started in a Paused state — it does not sync data until an MCAE admin navigates to Account Engagement Settings > Connectors, opens the connector, and clicks Resume. The connector must also be verified (pass an auth check) before resumption is allowed.

The v2 connector replaced the deprecated v1 connector. Key behaviors of v2:

Source: Salesforce Help — Connect Account Engagement and Salesforce (https://help.salesforce.com/s/articleView?id=sf.pardot_sf_connector_parent.htm)

Connector User Permissions

The connector user is the Salesforce identity the v2 connector authenticates as. It needs:

PermissionWhy Required
Marketing User checkbox (on User record)Required for campaign membership write operations
View All DataAllows connector to read all Lead, Contact, Account, Opportunity records across ownership
Modify All DataAllows connector to write sync'd field values back to CRM records
API EnabledRequired for REST API calls the connector makes
Read/Write FLS on all sync'd fieldsFLS on the connector user's profile controls which fields appear in sync — missing FLS silently prevents that field from syncing

The connector user should not be a real person's login. Service account best practice: a dedicated Salesforce user with a System Administrator or custom "MCAE Connector" profile that cannot be deactivated accidentally when someone leaves the organization.

Source: Salesforce Help — Configure the Account Engagement Connector User (https://help.salesforce.com/s/articleView?id=sf.pardot_sf_connector_user.htm)

Salesforce User Sync

Salesforce User Sync is the mechanism that manages MCAE user creation, deactivation, and role assignment entirely through Salesforce user records and profiles — eliminating the need to separately administer users in the MCAE admin UI.

How it works:

  1. An MCAE admin maps one or more Salesforce profiles to MCAE user roles (e.g., Salesforce "Marketing User" profile → MCAE "Marketing" role).
  2. Once User Sync is enabled, any Salesforce user assigned to a mapped profile is automatically provisioned in MCAE with the corresponding role.
  3. Deactivating a Salesforce user also deactivates their MCAE access automatically.
  4. MCAE-native user creation is disabled once User Sync is on.

Irreversibility: User Sync cannot be turned off once enabled in a standard production org without a Salesforce Support case. Enable it only when the profile-to-role mapping is finalized and tested.

Source: Salesforce Help — Salesforce User Sync Basics (https://help.salesforce.com/s/articleView?id=sf.pardot_user_sync_basics.htm)

Prospect Sync and Field-Level Sync Rules

MCAE syncs prospect records to Salesforce Lead and Contact records bidirectionally. Each synced field has a sync rule that governs conflict resolution when both sides have different values:

Important constraints:

Source: Salesforce Help — Account Engagement and Salesforce Sync (https://help.salesforce.com/s/articleView?id=sf.pardot_sf_sync_overview.htm)

Campaign Connector and Attribution

The MCAE campaign connector links MCAE campaigns to Salesforce campaigns for attribution reporting. Required setup:

  1. Each MCAE campaign must be associated with a Salesforce campaign (one-to-one mapping).
  2. Salesforce campaign Member Status values must be mapped to MCAE prospect activities (e.g., "Sent" → email send, "Opened" → email open, "Clicked" → email click, "Responded" → form fill).
  3. The Campaign Member record is created in Salesforce when a prospect engages with the associated MCAE campaign.

Without this mapping, MCAE sends do not generate Salesforce Campaign Member records, and first-touch / multi-touch attribution in CRM reports is missing.

Common Patterns

Pattern: Net-New Business Unit Setup

When to use: A new MCAE business unit has just been provisioned for the first time. Nothing is configured.

How it works:

  1. Install the Account Engagement Lightning App from AppExchange or Setup > App Manager (if not already present).
  2. In Salesforce Setup, designate the connector user: assign Marketing User checkbox, confirm View All Data, Modify All Data, and API Enabled permissions.
  3. In MCAE, navigate to Account Engagement Settings > Connectors. Open the auto-created Salesforce v2 connector. Verify the connector (it will perform an auth handshake). Click Resume to activate it.
  4. Configure the tracking domain under Account Engagement Settings > Domain Management. Set up a CNAME DNS record pointing your chosen subdomain to the MCAE tracking server. Without this, visitor tracking and email link tracking are broken.
  5. Set field-level sync rules for all mapped fields. Set high-traffic fields (First Name, Last Name, Email, Company) to "Use Most Recently Updated." Set CRM-authoritative fields (Account ID, Owner ID) to "Use Salesforce's Value."
  6. Map Salesforce profiles to MCAE user roles, then enable Salesforce User Sync. Verify that existing MCAE users are not orphaned (they must have matching Salesforce user records before sync is turned on).
  7. Configure the campaign connector: create a Salesforce campaign for each MCAE campaign, set Campaign Member Status values, and verify that campaign membership is created on a test form submission.

Why not configure User Sync before the connector is active: User Sync depends on a functioning connector. Enabling it before connector activation leaves the BU in an inconsistent state where user records cannot propagate.

Pattern: Multi-Business-Unit Org

When to use: The Salesforce org has multiple MCAE business units (e.g., one per region or product line).

How it works:

  1. Each BU has its own connector. Each connector has its own connector user (or a shared service account with BU-specific permission sets).
  2. Each BU has its own MCAE campaign, prospect, and asset namespace. Prospects do not automatically share across BUs. A Salesforce Lead/Contact can exist in multiple BUs but must be explicitly added to each BU.
  3. Users are assigned to BUs individually. A user cannot belong to two BUs in the same org simultaneously via the standard UI. If a Salesforce user needs access to multiple BUs, they need separate Salesforce user records (one per BU) or a Salesforce Support-assisted BU access grant.
  4. Tracking domains must be configured per BU. Reusing the same domain across BUs causes tracking attribution to be ambiguous.

Why not use one BU for all divisions: Single-BU orgs are simpler but restrict segmentation, campaign autonomy, and reporting to a flat namespace. Multi-BU is the standard pattern for enterprises with distinct marketing teams that should not share prospect lists.

Decision Guidance

SituationRecommended ApproachReason
New BU just provisioned, connector shows PausedNavigate to Account Engagement Settings > Connectors, verify and resume the v2 connectorDefault state is Paused; sync will not start until explicitly activated
Prospects not syncing despite active connectorAudit connector user FLS on all synced objects and fieldsMissing FLS silently excludes fields from sync; connector does not raise an obvious error
Marketing team managed separately in MCAE and SalesforceEnable Salesforce User Sync after mapping profiles to rolesEliminates dual-admin burden; Salesforce deactivation automatically revokes MCAE access
Field value conflicts between MCAE and CRMSet conflict-prone fields to "Use Most Recently Updated"Prevents one system permanently overwriting legitimate edits from the other
CRM campaign attribution missing in reportsConfigure campaign connector with Campaign Member Status mappingWithout mapping, MCAE activities do not generate Campaign Member records in CRM
Visitor tracking not recording page visitsConfigure tracking domain CNAME in DNS and in MCAE Domain ManagementTracking pixel will not fire until a properly configured tracking domain is active
User needs access to multiple BUs in same orgUse separate Salesforce user records per BU or open a Salesforce Support caseStandard MCAE does not support one Salesforce user being active in multiple BUs simultaneously

Step-by-step instructions for an AI agent or practitioner working on this task:

  1. Verify Account Engagement Lightning App is installed. In Salesforce Setup, search for App Manager and confirm the Account Engagement Lightning App is present and assigned to appropriate admin and marketing profiles. Without it, no MCAE navigation appears in Lightning.
  2. Create and configure the connector user. In Salesforce Setup > Users, identify or create the designated connector service account. Confirm it has: Marketing User checkbox enabled, View All Data, Modify All Data, API Enabled permissions, and read/write FLS on every field intended for sync. Document the user's profile and permission set assignments.
  3. Activate the Salesforce v2 connector. In Account Engagement Settings > Connectors, open the auto-created connector. Run the verification (auth handshake). Click Resume. Confirm the connector status changes from Paused to Active. Monitor the connector status page for the first 15 minutes to catch auth errors.
  4. Configure the tracking domain. In Account Engagement Settings > Domain Management, add the tracking subdomain. Create the corresponding CNAME DNS record at the domain registrar pointing to the MCAE tracking server hostname. Allow DNS propagation (up to 24–48 hours). Verify the domain shows as Active in MCAE.
  5. Set field-level sync rules. Review the default sync rule for each mapped field. Set CRM-authoritative fields (Owner, Account lookup, custom CRM IDs) to "Use Salesforce's Value." Set MCAE-authoritative fields (marketing opt-out, MCAE score, grade) to "Use Pardot's Value." Set shared fields (name, company, phone) to "Use Most Recently Updated."
  6. Enable Salesforce User Sync. Map Salesforce profiles to MCAE user roles in Account Engagement Settings > User Management. Verify that every current MCAE user has a matching Salesforce user record. Enable User Sync. Confirm that existing MCAE users are synchronized to the correct roles and that newly added Salesforce users on mapped profiles appear in MCAE automatically.
  7. Configure campaign connector and validate end-to-end sync. Associate MCAE test campaigns with Salesforce campaigns. Map Campaign Member Status values. Submit a test form fill, confirm a new prospect is created in MCAE, synced to a Salesforce Lead or Contact, and a Campaign Member record is created in the associated Salesforce campaign. Run through the review checklist.

Review Checklist

Run through these before marking work in this area complete:

Salesforce-Specific Gotchas

Non-obvious platform behaviors that cause real production problems:

  1. Connector starts Paused — sync never starts without explicit activation — Every new MCAE business unit auto-creates a v2 connector in a Paused state. This is not an error; it is the designed default. Practitioners who expect sync to begin immediately after BU provisioning will wait indefinitely. The fix is to navigate to Account Engagement Settings > Connectors, verify the connector, and click Resume.
  2. Connector user FLS silently blocks field sync without an error — If the connector user's profile does not have read or write permission on a specific field, that field simply does not sync. There is no error in the connector status, no sync failure alert, and no log entry visible to the admin. Practitioners must proactively audit FLS on every field, not rely on the system to surface missing permissions.
  3. User Sync is irreversible — enabling it permanently changes the user management model — Once Salesforce User Sync is turned on, MCAE-native user creation and role editing in the MCAE admin UI are hidden. Rolling this back requires a Salesforce Support case. Enable User Sync only after testing profile-to-role mappings in a sandbox and confirming every active MCAE user has a matching Salesforce record. Do not enable User Sync as a quick step during initial setup without this verification.
  4. Prospect email address is the sync key — duplicate emails cause phantom records — MCAE matches CRM Leads and Contacts to prospects by email address. If the same email exists as both a Lead and a Contact in Salesforce, MCAE creates two separate prospects, one for each. If the email exists in MCAE and a newly imported CRM record uses the same email, a sync conflict can result in data overwrite rather than merge. Deduplication should be run in both systems before the first sync.
  5. Recycle Bin sync is off by default — but enabling it retroactively deletes MCAE prospects — The Recycle Bin sync option causes MCAE prospects to be archived (soft-deleted) when their matching CRM Lead or Contact is deleted. This setting is off by default. If it is enabled after the BU has been running, any CRM records already in the Recycle Bin will trigger prospect archival on the next sync cycle. Turning this on without auditing the Recycle Bin first can cause unexpected bulk prospect deletion.

Output Artifacts

ArtifactDescription
Connector activation checklistStep-by-step verification that the v2 connector is active, authenticated, and syncing
Connector user permission matrixTable of required Salesforce permissions and FLS for the connector service account
Field sync rule matrixList of all synced fields with their configured sync rule and ownership rationale
Salesforce User Sync enablement guideProfile-to-role mapping table and step-by-step User Sync activation sequence
Campaign connector configuration stepsInstructions for linking MCAE campaigns to Salesforce campaigns with Member Status mapping
Tracking domain setup checklistDNS CNAME configuration steps and MCAE Domain Management activation verification
End-to-end test scriptForm fill → prospect creation → CRM sync → Campaign Member creation validation steps

Package files