--- schema_version: "1" id: 9ee9438fb325fc298971ed931207e6fbc35bd4a795f2e772bba0c1be1b93989d title: Authentication FAQs collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_co_authentication_faqs.md canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_co_authentication_faqs.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 69497f9ace0d5934056294c9046d88bd9d2924a5b98ba71d7575ede3c2a0fdce description: Answers to your questions about Marketing Cloud Connect for Marketing Cloud Engagement authentication, including Connected Apps and OAuth 2.0. products: - Marketing - Cross Cloud release: "264" --- # Authentication FAQs Answers to your questions about Marketing Cloud Connect for Marketing Cloud Engagement authentication, including Connected Apps and OAuth 2.0. How Do We Authenticate Between the Clouds? Marketing Cloud Connect uses Connected App and OAuth 2.0, trusted authentication tools. These tools allow you to work seamlessly across Sales Cloud, Service Cloud, and Engagement without the need to store credentials. Connected App authenticates users from Engagement into Sales and Service Clouds. OAuth 2.0 authenticates users from Sales and Service Clouds into Engagement. What Are Connected Apps? Connected Apps are Salesforce managed packages used to connect applications to Salesforce using APIs. What Are the Benefits of Connected App Authentication? Connected App authentication is a secure connection and authentication mechanism between Sales Cloud, Service Cloud, and Engagement. Connected App doesn’t require you to store Sales or Service Cloud passwords in Engagement. It also prevents SOAP and REST API calls made by Marketing Cloud Connect from counting against your rolling 24-hour limit. Does Connected App Authentication Remove All API Limits? No. Connected App Authentication only excludes SOAP, REST, and BULK API calls made by Marketing Cloud Connect. Concurrent API request limits are still enforced. Most calls made by Marketing Cloud Connect are SOAP and REST. BULK API calls are only used by Synchronized Data Extension Refresh when the feature is enabled. Is Connected App Authentication Required? Yes. As of June 1, 2016, all Marketing Cloud Connect customers are required to use Connected App Authentication. Can I Send to CRM Audiences While Upgrading to Connected App Authentication? No. The connection between Sales Cloud, Service Cloud, and Marketing Cloud Engagement is broken during the upgrade process, so ensure that all Marketing Cloud Connect activities are paused. All sends to reports, campaigns, contacts, leads, and Salesforce data extensions fail. Marketing Cloud Engagement sends that don’t involve Marketing Cloud Connect aren’t affected. We suggest scheduling a 1–2 hour outage depending on your number of connected users. Can I Send to Traditional Engagement Audiences While Upgrading My Account Authentication? Yes. Normal Engagement sends continue to work. Can Connected App Authentication Be Rolled Back After It’s Enabled? No. After you authenticate using Connected App Authentication, you can’t revert to legacy authentication. What Is OAuth 2.0? OAuth 2.0 Authentication uses access tokens to provide a secure connection between the clouds, without storing any Engagement user passwords in Sales and Service Clouds. When Is OAuth Implemented? Will the User Experience Change? This enhanced authentication is available starting with the 208.1 managed package release. After upgrading, existing Marketing Cloud Connect users are prompted to reenter their Marketing Cloud Engagement credentials the next time they access Marketing Cloud Connect. The rest of the user experience remains the same. Is OAuth 2.0 Authentication Required? Yes. All accounts that are upgraded to the 208.1 managed package or newer use OAuth 2.0. How Do I Download and Complete This Update? To reduce downtime or impact to your business, follow these steps if you’re upgrading from an older version of the managed package: 1. To understand feature changes in the 208.1 managed package, review the [latest releases](https://help.salesforce.com/s/articleView?id=mktg.mc_co_upgrade_to_the_latest_features.htm&release=264.0.0&type=5 "To make sure that you have the most recent features and bug fixes before each release, we automatically update the managed package in your production org to the previously released version. In addition, your non-production org is upgraded to the newest version when the managed package is released. This process provides you with a full release cycle to test the new package before we auto-update your production org.") page. 2. To minimize downtime if an unexpected error occurs, schedule the upgrade during off-peak hours. 3. Allow all scheduled sends to complete before starting the upgrade, if possible. 4. Ensure that you can log in to Engagement using the current API user credentials. 5. Follow the steps on the [Install Managed Package](https://help.salesforce.com/s/articleView?id=mktg.mc_co_install_marketing_cloud_connect.htm&release=264.0.0&type=5 "Install the Marketing Cloud Connect for Marketing Cloud Engagement managed package in your account.") page. After upgrading, existing Marketing Cloud Connect users are prompted to reenter their Engagement credentials the next time they access Marketing Cloud Connect. 6. Verify that Marketing Cloud Connect API user credentials migrated after upgrading by navigating to the Marketing Cloud tab in Sales or Service Cloud. How Can I Verify That Marketing Cloud Connect API User Credentials Migrated After Upgrading to OAuth 2.0? If the user didn’t migrate, non-Enterprise 2.0 accounts are prompted to enter Marketing Cloud Connect API user credentials. Enterprise 2.0 accounts follow these steps to confirm: 1. In Sales or Service Cloud, navigate to the Marketing Cloud tab. 2. Click **Configure Marketing Cloud Connector**. 3. Click **Manage Business Units**. 4. Confirm that previously active Business Units are still active. 5. If Marketing Cloud Connect API user credentials didn’t migrate, click **Change API User** from the configuration page. 6. Enter the Marketing Cloud Connect API user credentials and save. 7. Click **Manage Business Units**. 8. Confirm that previously active Business Units are now active. #### See Also - [Authentication Between Clouds](https://help.salesforce.com/s/articleView?id=mktg.mc_co_authentication.htm&release=264.0.0&type=5 "Connected App Authentication is a secure authentication mechanism used by Marketing Cloud Connect to connect from Marketing Cloud Engagement to Sales or Service Cloud. Now your users are authenticated automatically without Sales or Service Cloud user password management.") - [Upgrade to Connected App](https://help.salesforce.com/s/articleView?id=mktg.mc_co_upgrade_to_connected_app_authentication.htm&release=264.0.0&type=5 "Upgrade your account to use Connected App Authentication, which is required for all Marketing Cloud Connect for Marketing Cloud Engagement accounts as of June 1, 2016.") - [Connected Apps](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_overview.htm&language=en_US) - [API Request Limits and Allocations](https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm) - [Authorize Apps with OAuth](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_authenticate.htm&language=en_US)