Salesforce Docs Portal

Increase Login Security by Using Tenant-Specific Endpoint Isolation

Enterprises that have multiple Marketing Cloud Engagement accounts can use Tenant-Specific Endpoint (TSE) Isolation for additional login security. If you turn on this feature, users who use single sign-on (SSO) to access Marketing Cloud Engagement can only do so by using a unique URL that’s specific to each account, as opposed to using a global login endpoint.

Note
Note Marketing Cloud Engagement accounts created after the Summer ’24 release use TSE Isolation by default. These steps apply only to accounts that were created before the Summer ’24 release.

Step 1: Confirm the Settings for your Identity Provider

Before you turn on TSE Isolation, confirm that your Identity Provider (IdP) uses TSE URLs, rather than a global login endpoint.

There are two global login endpoints: auth.s1.exacttarget.com and mc.login.exacttarget.com. If your IdP uses either of these URLs, or if it uses a TSE for another account, change them to your tenant-specific login URLs.

  1. In Marketing Cloud Engagement Setup, in the Quick Find box, enter security, and then select Security Settings.
  2. Next to SSO SAML Metadata, click Download Metadata.
  3. Save the metadata file to your computer and open it.
  4. Confirm that the settings for your IdP match those specified in the metadata file. This table lists the values in the metadata file and their corresponding IdP settings. For each value, use the URL specified in the Location attribute.
    Value in Metadata File IdP Setting
    <md:AssertionConsumerService> Assertion Consumer Service (ACS)
    <md:SingleLogoutService> Single Logout (SLO)
    <init:RequestInitiator> Request Initiation
    <md:EntityDescriptor> Service Provider Entity ID

Additionally, if your IdP configuration specifies any of these options, make sure that they use your TSE domain:

  • Relay State
  • Sign-on URL
  • Start URL
  • Application URL

Step 2: Verify and Distribute your Service Provider-Initiated Links

If your account uses Service Provider-Initiated (SP-Init) links, validate that these links use your TSE URL, rather than a global login URL. After you confirm the SP-Init links, distribute them to your users.

  1. In Setup, in the Quick Find box, enter security, and then select Security Settings.
  2. In the Single Sign-On Settings section, next to Marketing Cloud SP Initiated Link, copy the URL.
  3. Make sure that your users log in by using the SP-Init URL.

    If your users log in to Marketing Cloud Engagement by going to a login URL, share the SP-Init URL with your users.

    If your users log in to Marketing Cloud Engagement through a single-sign-on portal, configure the portal to use the SP-Init URL. For more information, see the setup documentation for your IdP.

Step 3: Enable TSE Isolation

After you validate your SSO configuration, turn on TSE Isolation for your account.

Important
Important

Verify that your IdP is configured to use your TSE URLs before you turn on TSE Isolation. If you turn on the feature but the configuration for your Identity Provider is incorrect, your users won’t be able to log in to Marketing Cloud Engagement.

You can turn this feature on or off any number of times within the first seven days after you enable it. After seven days, contact Salesforce Support to change this setting.

  1. In Setup, in the Quick Find box, enter security, and then select Security Settings.
  2. Under Single Sign-On Settings, turn on Enable TSE SSO Isolation.
  3. Save your changes.