Managing user access in Account Engagement (Pardot) has become more complex since its full integration into the Salesforce platform. Whether you’re onboarding new team members or configuring roles for an existing marketing operation, understanding how permissions, licenses, and business unit assignments interact is key.
This guide walks you through everything you need to know to manage Pardot access effectively and securely within Salesforce.
Salesforce Users vs. Pardot Users: Start with the Right License
Since the Spring ’21 release, Pardot-only login credentials are no longer supported. Every user must now authenticate via Salesforce, which fundamentally changes how access is granted.
Two Paths to Access Pardot
- Standard Salesforce License: Suitable for users who actively use Salesforce beyond Pardot.
- Salesforce Identity License: For users who only need access to Account Engagement. Salesforce provides 100 free identity licenses for orgs with qualifying editions.
This shift centralizes user authentication but requires admins to rethink how to provision access efficiently.
Permission Sets: What You Need to Assign
To access the Account Engagement Lightning App, every user needs certain permission sets attached to their Salesforce user record.
Out-of-the-Box Permission Sets
- Sales Cloud User
- CRM User
- Service Cloud User
- Account Engagement User (designed for identity-licensed users)
You can also create custom permission sets to allow more granular control. But beware – custom sets won’t automatically receive new permissions introduced in future Salesforce releases.
Additional Permissions to Consider
For users to carry out advanced marketing functions, they may need access to:
- Drag and Drop Content Builder
- Activate Email for Automation
- Manage Email Content
- Salesforce CMS and related permissions
Admin Setup Permissions
Pardot admins also require:
- View Setup and Configuration
- Manage Marketing Setup Tasks
- Manage Profiles and Permission Sets
- Assign Permission Sets
Connected Apps: Don’t Forget B2BMA Canvas
Users must also be granted access to the B2BMA Canvas connected app via:
- Setup > Manage Connected Apps
- Select b2bma_canvas
- Manage access via Profiles or Permission Sets
Making the Account Engagement Lightning App Visible
Even after all permissions are set, users might not see the Account Engagement App in their App Launcher. Here’s what to check:
- Go to Setup > App Menu and confirm the app is marked “Visible in App Launcher.”
- If still hidden, go to Setup > App Manager, find the Lightning App, and edit profile access under the “User Profiles” tab.
Enabling Salesforce User Sync
User Sync allows you to manage Account Engagement user access directly from Salesforce profiles. It also makes Pardot user records read-only and reliant on Salesforce data.
Before You Enable It
It’s a one-way switch – once turned on, User Sync can’t be disabled. Always review the User Sync Enablement Guide before proceeding. Setup steps may differ based on whether your business unit is using a legacy or upgraded configuration.
Mapping Salesforce Profiles to Pardot Roles
Once User Sync is enabled, assigning users to roles in Account Engagement is handled by mapping Salesforce profiles to Pardot roles. These define the feature access level inside the platform.
The Four Standard Roles
| Role | Description |
| Administrator | Full access to all settings and data |
| Marketing | Access to most campaign and automation features |
| Sales Manager | Views and manages assigned prospects and reports |
| Sales | Basic access to leads and prospect activities |
If default roles don’t suit your org’s needs, you can create custom roles – this is possible only on Advanced or Plus editions (with an additional add-on).
You can even clone an existing role and tweak permissions for specific use cases, such as limiting access to automation rules for certain marketers.
Assigning Users to the Right Business Unit
Each Account Engagement instance (business unit) must have users explicitly assigned to it in order to access it. This step can also override User Sync role mappings.
Assignment Categories
- Marketing Users: Obeys profile-to-role mapping defined in User Sync.
- Sales Users: Always assigned to the lowest role, regardless of mapping, to limit access.
This is especially useful when you want to restrict certain sales reps from accessing automation and campaign features. Assign them as “Sales Users” instead.
Restricting Prospect Import/Export Access
To add another layer of control, you can set limits on email sends, imports, and exports by individual user.
How to Set Prospect Limits
- Go to Account Engagement Settings
- Navigate to User Management > Users
- Click on a user and then Edit
- Scroll to the Security Limits section to configure
This is particularly helpful in highly regulated industries where data access must be tightly monitored.
Final Thoughts
Getting user access right in Account Engagement requires more than assigning a license or checking a few boxes. You need to understand how permission sets, roles, and business units interact – and how to use those levers to manage risk, protect data, and accelerate adoption across teams.
If you’re unsure about the best structure for your marketing team or want help optimizing user access, get in touch with our team. We’ll help you design a scalable, secure, and compliant setup tailored to your business goals.