# Encryption, tokenization, IP allowlists and SSO

*Marketing Cloud Engagement Developer Study Guide · Security · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer/security/encryption-tokenization-ip-allowlists-and-sso*

The options that protect data and access in Marketing Cloud Engagement: Field-Level Encryption and its keys, Shield's Data at Rest Encryption, Tokenized Sending, the login IP allowlist and its modes (with blocking mode becoming mandatory), SAML single sign-on, and Audit Trail records.

- Certification: Salesforce Marketing Cloud Engagement Developer
- Exam section: Security
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-developer

**Official exam objective:**

> Identify different options to secure data in Marketing Cloud.

## What the exam expects

- Choose between Field-Level Encryption, Data at Rest Encryption and Tokenized Sending from where sensitive data may live and what code must change.
- Plan Field-Level Encryption: Professional Services, Contact Builder data extensions, per-business-unit keys, Journey Builder settings and key rotation.
- Configure the login IP allowlist's three modes, populate it, and avoid locking yourself out.
- Describe SAML 2.0 single sign-on limits and setup order.
- Retrieve Audit Trail records for investigations and outside tools.
- Key terms: **Field-Level Encryption** (encrypts chosen data extension fields at rest, decrypted at send time); **Data at Rest Encryption** (Shield's file-system encryption, transparent to the application); **Tokenized Sending** (sensitive data passed by API at send time, never stored); **monitoring mode** and **blocking mode** (the allowlist settings that log, or log and deny, unlisted logins); **KEK** (the key encryption key that protects other keys).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Field-Level Encryption | Requires Professional Services; decrypted at send time | [Field-Level Encryption](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5&language=en_US) |
| Encrypted data extensions | Contact Builder only; text or email address data | [Field-Level Encryption](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5&language=en_US) |
| KEK rotation | At least one time per year | [Field-Level Encryption](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5&language=en_US) |
| Shield versions | Shared or dedicated database; both include Encryption at Rest and Advanced Audit Trail | [Marketing Cloud Engagement Shield](https://help.salesforce.com/s/articleView?id=mc_overview_mc_shield.htm&language=en_US&type=5) |
| Suggested IP ranges | Based on the past 6 months of logins | [Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mc_overview_enable_allowlisting.htm&language=en_US&type=5) |
| Allowlist permission | Marketing Cloud Administrator | [Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mc_overview_enable_allowlisting.htm&language=en_US&type=5) |
| Mandatory blocking | By January 2027; covers UI and API access | [Mandatory IP Allowlisting](https://help.salesforce.com/s/articleView?id=005387198&type=1) |
| SAML | Up to one SAML key per account | [Security Settings and Tools](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5) |

## Check yourself

- Does the login IP allowlist restrict API calls as well as UI logins?
- When can't Salesforce offer recommended IP ranges for an account?
- Why must an SSO setup support single logout?
- Which time zone do Audit Trail records use?

## Sources

- [Marketing Cloud Engagement Developer Exam Guide](https://help.salesforce.com/s/articleView?id=005298954&language=en_US&type=1)
- [Security Settings and Tools for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_security_settings.htm&language=en_US&type=5)
- [Field-Level Encryption in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption.htm&type=5&language=en_US)
- [Marketing Cloud Engagement Shield](https://help.salesforce.com/s/articleView?id=mc_overview_mc_shield.htm&language=en_US&type=5)
- [Enable and Configure the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mc_overview_enable_allowlisting.htm&language=en_US&type=5)
- [Mandatory IP Allowlisting in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=005387198&type=1)
- [Single Sign-On Authentication Using SAML 2.0](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_single_sign_on_authentication_via_saml_2.htm&type=5&language=en_US)
- [Enable SAML 2.0 Single Sign-On Authentication](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_enable_saml_task.htm&type=5&language=en_US)
- [Audit Trail](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_audit_trail.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Developer pack (USD $19): https://www.certifyforce.com/practice-exams