---
schema_version: "1"
id: 7a6edf838ba37bd57f520fe4baff3865853be17e5fdf8f5082c2dbb2e2b5dd12
title: Authentication Between Clouds
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_co_authentication.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_co_authentication.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fe3507bc742ee85ba9ab4e65cb3d314259042824aac07a9963933f76a455217c
description: Connected App Authentication is a secure authentication mechanism used by Marketing Cloud Connect to connect from Marketing Cloud Engagement to Sales or Service Cloud. Now your users are authenticated automatically without Sales or Service Cloud user password management.
products:
  - Marketing
  - Cross Cloud
release: "264"
---
# Authentication Between Clouds

Connected App Authentication is a secure authentication mechanism used by Marketing Cloud Connect to connect from Marketing Cloud Engagement to Sales or Service Cloud. Now your users are authenticated automatically without Sales or Service Cloud user password management.

Authentication tools connect your users automatically between Engagement, Sales Cloud, and Service Cloud to create a secure, seamless experience working with Marketing Cloud Connect. After Salesforce admins complete the initial setup and configuration, users log in once to Marketing Cloud Connect and are automatically authenticated in the future.

## Authentication from Engagement into the Sales and Service Clouds

Connected App Authentication is a secure authentication mechanism used by Marketing Cloud Connect. It removes SOAP and REST API limits for Marketing Cloud Connect. Connected App Authentication doesn’t lift BULK API limits. API calls made into Engagement don’t count against your daily limit.

Connected App authentication is required for all Marketing Cloud Connect customers as of June 1, 2016. It’s available with all versions of Marketing Cloud Connect. New customers who complete all steps to connect clouds installed Connected App authentication. If you’re an existing customer with an older version of the managed package, complete all steps to upgrade to Connected App Authentication.

## Authentication from the Sales and Service Cloud into Engagement

Tenant-specific OAuth Authentication uses the JWT bearer token flow and access tokens to provide a secure connection between the clouds, without storing Engagement user passwords within Sales and Service Clouds. This enhanced authentication is available with the 220 or newer managed package release.

To reduce downtime or impact to your business, follow these steps if you’re upgrading from an older version of the managed package.

- Allow all scheduled sends to complete before starting the upgrade, if possible.
- Ensure that you can log in to Engagement using the current API user credentials.
- To minimize downtime if an unexpected error occurs, schedule the upgrade during off-peak hours.
- Install the managed package.
- In Sales or Service Cloud in the Marketing Cloud Configuration Settings, enable tenant-specific OAuth Endpoints.
- Click **Connect to Marketing Cloud**.
- Enter the API user credentials.
- Click **Log-in**.

When the upgrade completes, verify that Marketing Cloud Connect API user credentials converted to the new authentication framework by navigating to the Marketing Cloud tab in Sales or Service Cloud. If the API user didn’t migrate, you’re prompted to enter the API user credentials. If you have an Enterprise 2.0 Engagement account, click Manage Business Units and confirm that previously active business units are active. Add business units if needed and save. Also, confirm the API user migration for non-Enterprise 2.0 accounts by completing a triggered send test.

- **[Upgrade to Connected App](https://help.salesforce.com/s/articleView?id=mktg.mc_co_upgrade_to_connected_app_authentication.htm&release=264.0.0&type=5)**  
    Upgrade your account to use Connected App Authentication, which is required for all Marketing Cloud Connect for Marketing Cloud Engagement accounts as of June 1, 2016.
- **[Troubleshoot Connected App](https://help.salesforce.com/s/articleView?id=mktg.mc_co_troubleshoot_connected_app.htm&release=264.0.0&type=5)**  
    Follow these tips to troubleshoot your Connected App authentication for Marketing Cloud Connect for Marketing Cloud Engagement.

#### See Also

- [Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&language=en_US)
- [Authorize Apps with OAuth](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authenticate.htm&language=en_US)
- [Set Up Connected App Authentication](https://help.salesforce.com/s/articleView?id=mktg.mc_co_set_up_authentication.htm&release=264.0.0&type=5 "Set up connected app authentication for Marketing Cloud Connect for Marketing Cloud Engagement. This mechanism authenticates between Sales Cloud, Service Cloud, and Engagement without requiring you to store passwords in Engagement. It also prevents SOAP and REST API calls made by Marketing Cloud Connect from counting against your rolling 24-hour limit.")