---
schema_version: "1"
id: 75e3d312c927ab249a016c1b617f40e4021faa8476db3ec9b4384f90cc4088d6
title: Increase Login Security by Using Tenant-Specific Endpoint Isolation
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_sso_tse_isolation.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_sso_tse_isolation.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a998ebe31f66d155ca1bbf2858aefadc1fd27ced050be07b9a4d446b9e000010
description: Enterprises that have multiple Marketing Cloud Engagement accounts can use Tenant-Specific Endpoint (TSE) Isolation for additional login security. If you turn on this feature, users who use single sign-on (SSO) to access Marketing Cloud Engagement can only do so by using a unique URL that’s specific to each account, as opposed to using a global login endpoint.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Increase Login Security by Using Tenant-Specific Endpoint Isolation

Enterprises that have multiple Marketing Cloud Engagement accounts can use Tenant-Specific Endpoint (TSE) Isolation for additional login security. If you turn on this feature, users who use single sign-on (SSO) to access Marketing Cloud Engagement can only do so by using a unique URL that’s specific to each account, as opposed to using a global login endpoint.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png)

Note Marketing Cloud Engagement accounts created after the Summer ’24 release use TSE Isolation by default. These steps apply only to accounts that were created before the Summer ’24 release.

## Step 1: Confirm the Settings for your Identity Provider

Before you turn on TSE Isolation, confirm that your Identity Provider (IdP) uses TSE URLs, rather than a global login endpoint.

There are two global login endpoints: auth.s1.exacttarget.com and mc.login.exacttarget.com. If your IdP uses either of these URLs, or if it uses a TSE for another account, change them to your tenant-specific login URLs.

1. In Marketing Cloud Engagement Setup, in the Quick Find box, enter security, and then select Security Settings.
2. Next to SSO SAML Metadata, click **Download Metadata**.
3. Save the metadata file to your computer and open it.
4. Confirm that the settings for your IdP match those specified in the metadata file. This table lists the values in the metadata file and their corresponding IdP settings. For each value, use the URL specified in the `Location` attribute.
    
     
    | Value in Metadata File | IdP Setting |
    | --- | --- |
    | `<md:AssertionConsumerService>` | Assertion Consumer Service (ACS) |
    | `<md:SingleLogoutService>` | Single Logout (SLO) |
    | `<init:RequestInitiator>` | Request Initiation |
    | `<md:EntityDescriptor>` | Service Provider Entity ID |

Additionally, if your IdP configuration specifies any of these options, make sure that they use your TSE domain:

- Relay State
- Sign-on URL
- Start URL
- Application URL

## Step 2: Verify and Distribute your Service Provider-Initiated Links

If your account uses Service Provider-Initiated (SP-Init) links, validate that these links use your TSE URL, rather than a global login URL. After you confirm the SP-Init links, distribute them to your users.

1. In Setup, in the Quick Find box, enter security, and then select **Security Settings**.
2. In the Single Sign-On Settings section, next to Marketing Cloud SP Initiated Link, copy the URL.
3. Make sure that your users log in by using the SP-Init URL.
    
    If your users log in to Marketing Cloud Engagement by going to a login URL, share the SP-Init URL with your users.
    
    If your users log in to Marketing Cloud Engagement through a single-sign-on portal, configure the portal to use the SP-Init URL. For more information, see the setup documentation for your IdP.

## Step 3: Enable TSE Isolation

After you validate your SSO configuration, turn on TSE Isolation for your account.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_important.png)

Important

Verify that your IdP is configured to use your TSE URLs before you turn on TSE Isolation. If you turn on the feature but the configuration for your Identity Provider is incorrect, your users won’t be able to log in to Marketing Cloud Engagement.

You can turn this feature on or off any number of times within the first seven days after you enable it. After seven days, contact Salesforce Support to change this setting.

1. In Setup, in the Quick Find box, enter security, and then select **Security Settings**.
2. Under Single Sign-On Settings, turn on **Enable TSE SSO Isolation**.
3. Save your changes.