# Login security, password policies and Audit Trail

*Marketing Cloud Engagement Administrator Study Guide · Setup · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator/setup/login-security-password-policies-and-audit-trail*

The Marketing Cloud Engagement security settings and their recommended values (session timeout, login expiry, lockout, username and password rules, FTP exemption), MFA that most tenants can't turn off and step-up reauthentication, the Login IP Allowlist, Connection Security, the Export Email Allowlist, and Basic versus Advanced Audit Trail.

- Certification: Salesforce Marketing Cloud Engagement Administrator
- Exam section: Setup
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator

**Official exam objective:**

> Given a scenario, implement the configuration of business units, users/permissions, and security/passwords.

## What the exam expects

- Pick the security setting and recommended value for a login threat: Session Timeout, Login Expires After Inactivity, Invalid Logins Before Lockout, Minimum Username Length.
- Configure Password Policies, including the FTP user exemption and password change emails.
- Explain MFA in Marketing Cloud Engagement: why most tenants can't disable it, which methods resist phishing, and when step-up authentication fires.
- Restrict where logins come from and where exports go, and confirm TLS 1.2 connections.
- Compare Basic and Advanced Audit Trail and say who can see which records and how to get them out.
- Key terms: **step-up authentication** (MFA again before a critical change); **PR-MFA** (phishing-resistant MFA); **Login IP Allowlist** (only listed IP ranges can log in); **Audit Trail** (access and activity records).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Session Timeout | Recommended 20 minutes | [Security Settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| Login expiry | 90 days or fewer; expired user needs an admin reset | [Security Settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| Lockout | Three attempts; admin unlocks | [Security Settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| Username and password length | Eight characters or more each | [Security Settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| Password history and expiry | History 8 or more; expire every 90 days | [Security Settings](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US) |
| MFA | Can't be disabled for most tenants | [Enable and Require MFA](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_transition.htm&language=en&type=5) |
| PR-MFA methods | Physical security keys and platform authenticators | [MFA](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa.htm&language=en_US&type=5) |
| Login IP Allowlist | Off by default; covers UI and API logins | [Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_ip_allowlist.htm&language=en_US&type=5) |
| Basic vs Advanced retention | 30 days vs 60 days | [Audit Trail](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail.htm&language=en&type=5) |
| Audit Trail visibility and time zone | Parent sees itself and all children; CST | [Audit Trail](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail.htm&language=en&type=5) |

## Check yourself

- Why isn't Login Expires After Inactivity recommended when the account has API users?
- When will an admin who already passed MFA be prompted again?
- Which MFA methods are phishing-resistant?
- How do you keep Audit Trail records longer than the retention window?

## Sources

- [Security Settings and Tools for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&type=5&language=en_US)
- [Multi-Factor Authentication for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa.htm&language=en_US&type=5)
- [Enable and Require MFA for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_mfa_transition.htm&language=en&type=5)
- [Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_ip_allowlist.htm&language=en_US&type=5)
- [Export Email Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_export_email_allowlist.htm&language=en_US&type=5)
- [Audit Trail](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail.htm&language=en&type=5)
- [Basic Audit Trail Metrics](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail_basic_metrics.htm&language=en_US&type=5)
- [Advanced Audit Trail Metrics](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail_advanced_metrics.htm&language=en_US&type=5)
- [Use Audit Trail](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_use_audit_trail.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 17 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Administrator pack (USD $19): https://www.certifyforce.com/practice-exams