Setup38% of the exam
Business units, roles and permission overrides
How business units split one Marketing Cloud Engagement account, how security settings inherit until a child changes one, which standard Marketing Cloud and Email Studio role fits a job, why an explicit deny beats a role, and how to add, administer and disable users.
Given a scenario, implement the configuration of business units, users/permissions, and security/passwords.
~8 min read · 19 practice questions ·
What the exam expects
- Design business units for teams that need their own brand and content inside one account, and know which editions offer them.
- Predict what a child business unit does when the parent's security settings change, including after an admin has edited the child.
- Choose the standard Marketing Cloud and Email Studio roles for a job, or a custom role or per-user permission instead.
- Resolve a conflict between a role that allows an action and an individual setting that denies it.
- Add, administer and retire users: the Add Users to Account permission, the API User option, multi-business-unit access and disabling instead of deleting.
- Key terms: business unit (a child area of an Enterprise or Enterprise 2.0 account with its own users, content and subscribers); standard role (a built-in bundle of permissions); custom role (an admin-defined bundle); explicit deny (a permission set to deny, which overrides any allow); API User (a user flag that stops the password expiring).
Key facts
Business unit availability
- Detail
- Enterprise and Enterprise 2.0 accounts
Cross-unit sharing
- Detail
- Shared items folder in the Content and Subscribers sections
Enterprise 1.0 tool
- Detail
- Email Studio Channel Management: nodes and channel members
Role conflict
- Detail
- Deny settings override allow roles
Security inheritance
- Detail
- Ends at the first security edit on the child; can't be reinstated
Roles per user
- Detail
- One standard Marketing Cloud role and one standard Email Studio role
Admin user
- Detail
- Select Add Users to Account when creating the user
API User option
- Detail
- Password doesn't expire
Removing a user
- Detail
- Disable only; sends and automations keep running
Disabled user's reports
- Detail
- Scheduled reports stop running
Sources for this section (6)
- Business Unitshelp.salesforce.com (opens in a new tab)
- Security Settings and Toolshelp.salesforce.com (opens in a new tab)
- Roles and Permissionshelp.salesforce.com (opens in a new tab)
- Add a Userhelp.salesforce.com (opens in a new tab)
- Usershelp.salesforce.com (opens in a new tab)
- Disable a Userhelp.salesforce.com (opens in a new tab)
- Why doesn't a child business unit pick up the parent's new password policy after an admin once edited the child's session timeout?
- When should an admin create a custom role instead of picking a standard one?
- Which Email Studio role reaches everything except email content?
- Why disable rather than delete a departed user who owned automations?
- What must be selected to let a new user create other users?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Marketing Cloud Engagement Administrator pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 20 lessons of the Marketing Cloud Engagement Administrator guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (19 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams