Marketing Cloud Engagement introduces several security enhancements to help you protect your account and data. These updates include a consolidated security dashboard for monitoring health scores, logging of Data Extension access in Advanced Audit Trail, and support for phishing-resistant multi-factor authentication (PR-MFA) methods, such as Touch ID and Face ID. Admins can also manage login allowlists by using recommended IP ranges. Step-up authentication protects against unauthorized access by requiring admins to reauthenticate before performing critical security tasks. A summary dashboard provides at-a-glance information about the API client secrets for your installed packages, and client secrets are revoked automatically if they’re compromised.
- Monitor the Security Posture of Your Account with the Security Dashboard
Get a single view of security settings for your Marketing Cloud Engagement account with the Security Dashboard. View an overall health score, review security factors grouped by category, and identify high-priority improvements, all in one place. To share your security posture with stakeholders, export a branded PDF report. - Monitor Data Extension Access Events with Advanced Audit Trail
Advanced Audit Trail now indicates when a user or API consumer views data in a Data Extension for compliance with data privacy regulations such as GDPR. Use audit logs to see which users accessed subscriber data and when they accessed it. - Protect Against Phishing by Using Platform Authentication Systems
Strengthen security by using platform-based authentication systems, including Touch ID and Face ID on Apple devices, Windows Hello, or passkeys, to log in to Marketing Cloud Engagement. Platform authentication methods are considered phishing-resistant multi-factor authentication (PR-MFA) systems. Marketing Cloud Engagement also supports other PR-MFA systems, such as authentication with hardware-based devices such as Yubikey. - Configure Your Login Allowlist Based on Recommended IP Ranges
Marketing Cloud Engagement tracks IP addresses used to log in to your accounts over the past six months and provides recommended ranges for your allowlist. After you review the suggested ranges, add IP ranges to your allowlist with a few clicks. - Reauthenticate Using MFA for Security Tasks
Some critical actions, such as changing security settings for an account, require Marketing Admins to reauthenticate. This change doesn’t apply to orgs that use single sign-on. - Update Single Sign-On Accounts to Use MFA
Accounts that use single sign-on must implement MFA systems with Authentication Method Reference (AMR) and Authentication Context Class Reference (ACC) claims. This requirement provides the highest level of security between your identity provider and Marketing Cloud Engagement. - Prepare to Rotate Client Secrets for Installed Packages
All installed package client secrets that you haven’t rotated since March 25, 2026 expire on September 30, 2026. All client secrets generated after March 25, 2026 have a 180-day expiration period, beginning on the day they’re generated. In the days before each client secret expires, you receive email notifications and see banner notifications in Marketing Cloud Engagement. - Protect Your Integrations with Automatic Client Secret Revocation
If we detect specific security threats related to an API integration in your account, we automatically revoke the client secret for the installed package. For example, if we detect that a client secret is exposed in a public repository, we revoke it, notify admins by email, and display a notification message in Marketing Cloud Engagement. If a follow-up security review determines that the secret isn’t compromised, we automatically restore it. This feature is enabled by default. Admins can’t turn it off. - Review Client Secret Statuses on the Installed Packages Summary Page
Review the status of active and staged client secrets for each installed package in your account on the Installed Packages page in Setup. For each package, the summary shows the revocation and expiration status for the client secret, the client ID, and the number of days since the last authentication call. - Review New and Upcoming Security Requirements for Marketing Cloud Engagement
To protect against evolving security threats, Salesforce updates security requirements. Review the newest authentication and login requirements for Marking Cloud Engagement accounts.