# Tenants, business units, roles and user access

*Marketing Cloud Engagement Foundations Study Guide · Marketing Cloud Engagement Basics · Last updated November 3, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-foundations/marketing-cloud-engagement-basics/tenants-business-units-roles-and-user-access*

How Marketing Cloud Engagement tenants, MIDs and business units divide an account by region, brand or team, and how roles, user licences and user security practices control who can do what inside each unit.

- Certification: Salesforce Marketing Cloud Engagement Foundations
- Exam section: Marketing Cloud Engagement Basics
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-foundations

**Official exam objective:**

> Identify solutions for regional or business related account structures as they relate to business units and corresponding permissions in Marketing Cloud Engagement.

## What the exam expects

- Identify the tenant type (Enterprise 2.0, Enterprise, Core, Agency) from a description of an account and say how many MIDs it holds.
- Recognise when a regional or brand split needs business units, which account types offer them and what a structure can mirror.
- Plan role assignment for a team: a role for the whole business unit, extra roles on one user, least privilege.
- Apply the user security and licence rules: one user per person or process, and which users count against the contract.
- Key terms: **tenant** (the top-level account plus whatever counts with it for that account type); **MID** (Member Identification Code, the ID of one account or business unit); **business unit** (a child account that controls access to and sharing of information); **role** (a set of permissions); **API user** (a user configured for an integration rather than a person).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Core tenant | A single account with one MID | [Tenant Types](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_tenant_types.htm&type=5&language=en_US) |
| Agency tenant | Every top-level and client account is its own tenant | [Tenant Types](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_tenant_types.htm&type=5&language=en_US) |
| Where to read a MID | Hover the account name, or Setup > Account Settings (Account ID) | [Learn Admin Basics](https://trailhead.salesforce.com/content/learn/modules/marketing-cloud-developer-basics/learn-administration-basics) |
| Business unit availability | Enterprise and Enterprise 2.0 accounts | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Cross-unit sharing | Shared items folder in Content and Subscribers | [Business Units](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5) |
| Standard roles per user | One Engagement role and one Email Studio role | [Roles and Permissions](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_roles.htm&type=5&language=en_US) |
| Role conflict | Deny overrides allow | [Assign a Role to All Business Unit Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_assign_a_role_to_a_business_unit.htm&type=5&language=en_US) |
| Licence count | API users count; disabled and AppExchange users don't | [Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_users.htm&language=en_US&type=5) |
| Removing a user | Disable only; users can't be deleted | [Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_users.htm&language=en_US&type=5) |

## Check yourself

- Why does Help warn against giving one user every role?
- Why does an Enterprise tenant differ from an Enterprise 2.0 tenant in Help's definition?
- What does the Data Manager Email Studio role cover?
- Which Email Studio role reaches all content and shared folders but no data or administrative features?

## Sources

- [Business Units in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_es_business_units.htm&language=en_US&type=5)
- [Learn Marketing Cloud Engagement Admin Basics (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/marketing-cloud-developer-basics/learn-administration-basics)
- [Marketing Cloud Engagement Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_users.htm&language=en_US&type=5)
- [Marketing Cloud Engagement Tenant Types](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_tenant_types.htm&type=5&language=en_US)
- [Roles and Permissions in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_roles.htm&type=5&language=en_US)
- [Assign a Role to All Business Unit Users](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_assign_a_role_to_a_business_unit.htm&type=5&language=en_US)
- [Assigning Marketing Roles](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_assign_roles.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Foundations pack (USD $19): https://www.certifyforce.com/practice-exams