---
schema_version: "1"
id: a800e29cf4b1eecf2d02b0d8435b2e779329eef793680b8fd436bfe599c03ebc
title: Upgrade to Tenant-Specific Endpoints Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_dm_add_tse_bu_flow.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_dm_add_tse_bu_flow.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: bee9f07c22c6e050b88da603225723dd94a16e58f9c6b8aa607b0727565c03bd
description: To enhance the performance of the Marketing Cloud Engagement platform, tenant-specific subdomains are assigned automatically to all customers. This automatic assignment improves API performance, creates a faster experience, and is required for some Marketing Cloud Engagement data centers. You can self-update any connected business units not already using Tenant-Specific Endpoints (TSE) authentication without disrupting any existing connections. All new connections automatically use TSE authentication.
products:
  - Marketing
  - Cross Cloud
release: "264"
---
# Upgrade to Tenant-Specific Endpoints Authentication

To enhance the performance of the Marketing Cloud Engagement platform, tenant-specific subdomains are assigned automatically to all customers. This automatic assignment improves API performance, creates a faster experience, and is required for some Marketing Cloud Engagement data centers. You can self-update any connected business units not already using Tenant-Specific Endpoints (TSE) authentication without disrupting any existing connections. All new connections automatically use TSE authentication.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d31878e39">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d31878e39 ">To enable authentication for Tenant-Specific Subdomains:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d31878e39 ">DMAdministrator license</td>

          </tr>
        </tbody>
      </table>

These instructions apply only to business units added before January 2020.

1. Log out of any active Marketing Cloud Engagement sessions.
2. In Salesforce, navigate to AppLauncher.
3. Select **Distributed Marketing Administration**.
4. In the Administration section, navigate to the **Critical Updates** section. Any authenticated business units using non-TSE authentication appear in the Business Units Ready to Prepare table. For example, Business\_unit.
    
    ![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_cross-cloud_products-264-0-0-production-enus/bd617332-480f-48e8-b283-3477883c1320/images/icon_tip.png)
    
    Tip If you don’t see anything here, all of your business units are authenticated using the appropriate authentication method.
5. In the Business Units Ready to Prepare table, determine the business unit you want to update, and select the **Prepare Business Unit** button. The business unit is removed from the table.
6. In the Administration section, navigate to Business Units. When the business unit is ready, it appears in the Business Units component under Administration > Business Units appended with \_tse\_migration. For example, Business\_unit\_tse\_migration.
7. In the Business Units component, click **Complete Log In** on the new business unit. Log in using your unique Marketing Cloud Engagement system user for Distributed Marketing.
8. Navigate back to the **Business Units** section.
9. Click the **Update Connection Information** button, and confirm the connection for the new business unit. For example, Business\_unit\_tse\_migration.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_cross-cloud_products-264-0-0-production-enus/bd617332-480f-48e8-b283-3477883c1320/images/icon_note.png)
    
    Note Now, your new business unit is authenticated. However, all of your existing campaigns and quick send messages are accessed using the business unit that uses non-TSE authentication. Update your existing campaigns and quick send messages to use the newly authenticated business unit next.
10. In the Administration section, navigate to Critical Updates. Any business units that were authenticated using the TSE authentication created with this migration flow appear. For example, Business\_unit\_tse\_migration.
11. In the Business Units Ready to Upgrade table, determine the business unit to upgrade, and select the **Upgrade Business Unit** button. The business unit is removed from the table and the system upgrades all connected Campaigns and Quick Send messages to use TSE authentication. When the migration is complete, the business unit appears in the Business Units component in the Business Units section in Administration. The business unit appears without the tse\_migration suffix, for example, Business\_unit. The business unit authenticated using non-TSE authentication is appended with \_deprecated. For example, Business\_unit\_deprecated.
12. Delete the business unit authenticated with legacy authentication.

#### See Also

- [IP Addresses for Inclusion on Allowlists in Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=mktg.mc_es_ip_addresses_for_inclusion.htm&language=en_US)
- [Your Subdomain and Your Tenant's Endpoints](https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/your-subdomain-tenant-specific-endpoints.html)