# Business units, roles and permission overrides

*Marketing Cloud Engagement Administrator Study Guide · Setup · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator/setup/business-units-roles-and-permission-overrides*

How business units split one Marketing Cloud Engagement account, how security settings inherit until a child changes one, which standard Marketing Cloud and Email Studio role fits a job, why an explicit deny beats a role, and how to add, administer and disable users.

- Certification: Salesforce Marketing Cloud Engagement Administrator
- Exam section: Setup
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator

**Official exam objective:**

> Given a scenario, implement the configuration of business units, users/permissions, and security/passwords.

## What the exam expects

- Design business units for teams that need their own brand and content inside one account, and know which editions offer them.
- Predict what a child business unit does when the parent's security settings change, including after an admin has edited the child.
- Choose the standard Marketing Cloud and Email Studio roles for a job, or a custom role or per-user permission instead.
- Resolve a conflict between a role that allows an action and an individual setting that denies it.
- Add, administer and retire users: the Add Users to Account permission, the API User option, multi-business-unit access and disabling instead of deleting.
- Key terms: **business unit** (a child area of an Enterprise or Enterprise 2.0 account with its own users, content and subscribers); **standard role** (a built-in bundle of permissions); **custom role** (an admin-defined bundle); **explicit deny** (a permission set to deny, which overrides any allow); **API User** (a user flag that stops the password expiring).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Business unit availability | Enterprise and Enterprise 2.0 accounts | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Cross-unit sharing | Shared items folder in the Content and Subscribers sections | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Enterprise 1.0 tool | Email Studio Channel Management: nodes and channel members | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Role conflict | Deny settings override allow roles | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Security inheritance | Ends at the first security edit on the child; can't be reinstated | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| Roles per user | One standard Marketing Cloud role and one standard Email Studio role | [Roles and Permissions](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_roles.htm&type=5&language=en_US) |
| Admin user | Select Add Users to Account when creating the user | [Add a User](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_add_a_user.htm&type=5&language=en_US) |
| API User option | Password doesn't expire | [Add a User](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_add_a_user.htm&type=5&language=en_US) |
| Removing a user | Disable only; sends and automations keep running | [Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_users.htm&language=en_US&type=5) |
| Disabled user's reports | Scheduled reports stop running | [Disable a User](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_disable_a_user.htm&type=5) |

## Check yourself

- Why doesn't a child business unit pick up the parent's new password policy after an admin once edited the child's session timeout?
- When should an admin create a custom role instead of picking a standard one?
- Which Email Studio role reaches everything except email content?
- Why disable rather than delete a departed user who owned automations?
- What must be selected to let a new user create other users?

## Sources

- [Business Units in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5)
- [Roles and Permissions in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_roles.htm&type=5&language=en_US)
- [Marketing Cloud Engagement Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_users.htm&language=en_US&type=5)
- [Add a User](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_add_a_user.htm&type=5&language=en_US)
- [Disable a Marketing Cloud Engagement User](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_disable_a_user.htm&type=5)
- [Security Settings and Tools for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 19 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Administrator pack (USD $19): https://www.certifyforce.com/practice-exams