Overview
The Salesforce Marketing Cloud integration reads seat usage from Marketing Cloud Engagement — who holds a seat, across which business units.
This is a different connection from Salesforce core. Marketing Cloud authenticates through an Installed Package against its own
marketingcloudapis.comendpoints, not through a connected app against your Salesforce org. It has its own tile and its own guide, and the two connections are stored independently — connecting one never overwrites the other.
Key Benefits
- Seat visibility across business units — who holds a Marketing Cloud seat, and where
- Reconciliation against your contract — seats purchased against seats in use
- Reclaim candidates — seats assigned to people with no matching activity
What you get
- A self-serve connection on the Integrations page
- Your Client ID and Client Secret stored encrypted, and checked against your authentication endpoint when you connect
- Connection status visible to your team, showing whether the credentials were accepted
Prerequisites
You need a License Logic account and a Marketing Cloud administrator. The Marketing Cloud side takes about ten minutes.
License Logic Requirements
- Account: active License Logic subscription
- Role: a role holding Settings: Edit — that is what the Connect action checks
- Page: Integrations in the left sidebar, which requires Integrations: View
If the Integrations page is missing, or Connect does nothing. These are two different permissions. Integrations: View shows the page and the tiles; Settings: Edit is what allows a connection to be made. A user can hold the first without the second, see the tile, and be unable to complete the connection. Your License Logic administrator grants both in People → Roles.
Marketing Cloud Requirements
- Account: an active Marketing Cloud Engagement account
- Permission: Installed Package | Administer — this is what allows the package and its API integration component to be created
- Your Business Unit ID (MID) if you have more than one business unit — see Step 3, which is the part of this setup most worth reading carefully
- Network: nothing to install. License Logic calls Marketing Cloud outbound over HTTPS
Components cannot be removed once added. Salesforce’s documentation is explicit that after you add an app or API integration component to an installed package, it cannot be removed from that package. Create the package deliberately rather than experimentally — you can always create another, but you cannot tidy this one up afterwards.
Setup Guide
There is one connection method: a Marketing Cloud Installed Package with a server-to-server API integration, which issues a Client ID and Client Secret used with OAuth 2.0. Steps 1 to 3 are done in Marketing Cloud; step 4 is done in License Logic.
Step 1: Create the Installed Package
- In Marketing Cloud, go to Setup → Apps → Installed Packages
- Click New
- Name the package — for example
License Logic Integration— and add a description - Save the package
Step 2: Add the API Integration component
- In the package, under Components, click Add Component
- Choose API Integration
- Choose the Server-to-Server integration type — this is the type that authenticates with a client ID and secret and no signed-in user
- Select the read permissions the integration needs, and save
Under the component details you will now find three values you need:
| Value | Where it appears | Used for |
|---|---|---|
| Client ID | API Integration component details | Identifies the integration |
| Client Secret | API Integration component details | Authenticates it. Treat as a password |
| Authentication Base URI | API Integration component details | The host License Logic authenticates against. Looks like mc123abc456.auth.marketingcloudapis.com |
Store the Client Secret securely and never expose it client-side. Salesforce’s own guidance is explicit on this point. Send it to License Logic by pasting it into the Connect form yourself — never by email or chat.
Step 3: Find your Business Unit ID (MID)
This field is optional to the Marketing Cloud API, and that is exactly why it needs explaining rather than skipping.
If you leave the MID blank and you have more than one business unit, the answer you get will be quietly incomplete. Salesforce’s documentation states that the account identifier parameter switches between business units, and that when it is omitted the access token is issued “in the context of the business unit that created the integration.” There is no error and no warning. An organisation with thirteen business units would be audited on one of them, and nothing on the screen would say so.
Find it at Setup → Account Settings; it is also shown in the account switcher next to each business unit. It is a number, for example 7161234.
Leave it blank only if you genuinely have a single business unit. If you are not sure how many you have, that is itself a good reason to check before connecting.
Step 4: Connect in License Logic
- In License Logic, click Integrations in the left sidebar
- Find the Salesforce Marketing Cloud tile and click Connect
- Enter your Auth subdomain host — the Authentication Base URI from Step 2, hostname only, with no
https://and no path - Enter your Business Unit ID (MID) from Step 3
- Paste the Client ID and Client Secret
- Click Connect
| Field | Required | What to enter |
|---|---|---|
| Auth subdomain host | Yes | mc123abc456.auth.marketingcloudapis.com. Hostname only. Must be a .marketingcloudapis.com address |
| Business Unit ID (MID) | No, but see Step 3 | Your MID from Setup → Account Settings. Blank means one business unit only |
| Client ID | Yes | From the API Integration component. Stored encrypted |
| Client Secret | Yes | From the API Integration component. Stored encrypted; never shown again |
License Logic encrypts the credentials, stores them, and makes one call to your authentication host to check them. If that call does not succeed, your credentials are still saved — see Troubleshooting.
What Data Is Synced
Users
Marketing Cloud exposes its user list through the AccountUser object on its SOAP API — this is a genuine difference from Salesforce core, where the same question is answered by a SOQL query. The REST Get User Info endpoint returns only the account attached to the access token, so it cannot answer “who holds a seat” on its own.
The fields that matter for seat management:
| Field | Used for |
|---|---|
| Name | Display name |
| The join key to your License Logic employee records | |
| Active status | Excludes disabled users from assigned-seat counts |
| Role | What kind of access the seat carries |
| Last login | Identifies assigned seats with no recent use |
| Business unit | Which business unit the seat belongs to |
Business unit scope
This is where the Business Unit ID you entered at setup does its work. The access token’s business-unit context is fixed at authentication. Supply the MID and the sync sees that business unit; omit it and the token resolves to the business unit that created the integration, silently. So the MID captured at connect determines how much of your estate this sync can see — which is why it is collected before the sync exists rather than after.
Where the purchased number comes from. Marketing Cloud does not publish an endpoint reporting how many seats you have bought — only who currently holds one. So the assigned side comes from the API and the purchased side comes from your Marketing Cloud contract in License Logic. That combination still answers the question that matters (bought against used); it is just worth knowing which half comes from where, particularly if your contract record is out of date.
Read-only, and narrow. The integration reads account and user records. It reads no journeys, data extensions, subscriber data, content or send history, and it writes nothing.
Where Your Salesforce Marketing Cloud Data Appears
Salesforce Marketing Cloud data lands in the places you already use to answer licence questions, rather than in a separate Salesforce Marketing Cloud area you would have to remember to visit.
Applications
Your Marketing Cloud row on the Applications page shows seat facts rather than sign-in counts:
- Total licences — the seats you hold, sourced from the Salesforce Marketing Cloud API rather than typed in by hand
- Assigned — how many of those seats are actually allocated to a person
- Breakdown by licence type — entitled against assigned, per licence, ordered so the largest gap is first. That top row is the one worth acting on, and it is rarely the alphabetically-first one
- Idle seats — the difference, which is the number that converts into a renewal conversation
Application drill-down
Opening Marketing Cloud shows every seat holder, their role, their business unit and when they last signed in — which is what makes a seat review possible across business units rather than one at a time.
Insights → Employee
Each employee’s record gains Salesforce Marketing Cloud as a source alongside SSO sign-in, desktop agent and card-spend data. Opening a person shows the applications they hold, so a leaver review or a role change can see the Salesforce Marketing Cloud seat in the same place as everything else they hold.
Suppliers and renewals
Because seat counts arrive as data rather than as a number someone typed into a contract, your Salesforce Marketing Cloud agreement can be compared against actual allocation as the renewal approaches — which is the moment the difference is worth money.
Marketing Cloud and Salesforce core appear as separate rows. They are different products with different seats and different costs, so merging them into one Salesforce line would hide exactly the distinction you are trying to see.
Two switches, not one. A tenant needs the integration connected and the licence display enabled for it. That is deliberate: it stops a seat panel appearing for a tenant whose connection cannot actually compute one, which would show an empty panel rather than an honest absence. We enable both together and tell you when we have.
Sync Schedule & Refresh
Daily sync
License Logic reads Salesforce Marketing Cloud once per day, overnight UTC, in the same window as our other licence integrations. Each run replaces the previous day’s picture, so revoked seats and new assignments are both reflected without anything to reconcile by hand.
Initial sync
Your first sync is scheduled once your connection is confirmed. It reads user records only, so it completes quickly regardless of how much sending data your account holds.
What triggers a sync
- Initial connection — your first sync is scheduled once your connection is confirmed
- Daily scheduled sync — automatically, once per day
- Reconnection — reconnecting with new credentials resumes syncing on the next scheduled run
A failed sync leaves yesterday’s data in place. If a run cannot complete — Salesforce Marketing Cloud is unreachable, or the credential has been revoked — License Logic keeps the previous successful result rather than emptying the panel. “This tenant has no licences” and “we could not read them today” look identical on screen, so we never let a failure produce the first one.
Disconnecting Salesforce Marketing Cloud
Disconnecting deletes your stored Salesforce Marketing Cloud credentials. They are removed from the database outright, not disabled behind a flag, so reconnecting means entering them again, and any data already synced is removed with them. Your Salesforce Marketing Cloud account itself is untouched, but you may need to issue a new credential there if you did not keep the original.
To disconnect:
- Go to Integrations in the left sidebar
- Find the Salesforce Marketing Cloud tile (showing “Connected”)
- Click Disconnect
- Confirm in the dialog
Revoking from the Salesforce Marketing Cloud side
In Marketing Cloud, go to Setup → Apps → Installed Packages, open the package, and delete it — or rotate the Client Secret on the API Integration component, which invalidates the copy License Logic holds. Either stops the connection immediately. Note that an individual component cannot be removed from a package; deleting the package is the way to remove the integration.
Revoking on the vendor side and disconnecting in License Logic are independent. Doing both is the complete removal: one stops the credential working, the other removes our copy of it.
Security & Data Handling
What License Logic holds
An Installed Package’s Client ID and Client Secret — never a user password. These are application credentials issued by Marketing Cloud. They cannot be used to sign in as a person, and they can be revoked without touching any user account. Optionally, your authentication host and Business Unit ID, neither of which is a secret.
| Control | Detail |
|---|---|
| Encryption at rest | AES-256-GCM with a random initialisation vector per value, applied before the value is written to storage |
| In logs | Never written. Connection events are logged with the credential values redacted |
| Retrievable via API | Never returned — not even to your own administrators. The connection-status endpoint is built from the non-secret fields only, so a secret cannot be read back through it |
| In transit | TLS 1.2 or above, passed in a request header or form body. Never placed in a URL or query string |
| Who can connect or disconnect | Only a user holding Settings: Edit in your License Logic tenant |
| Who can see the connection status | A user holding Integrations: View. Status shows the non-secret settings, whether the connection is verified, and when it was made |
| Tenant scope | Stored against your License Logic tenant. Connect, status and disconnect are all keyed on the caller’s own tenant, so no request from another customer can reach your connection |
| Permissions the credentials carry | The read permissions you selected on the API Integration component, and the business-unit scope of the token. License Logic cannot widen either |
| Relationship to Salesforce core | Stored separately. Connecting or disconnecting one has no effect on the other, and neither can overwrite the other |
Verification on connect
When you click Connect, License Logic stores your credentials and then makes one live call to Salesforce Marketing Cloud to check them. The tile shows verified if that call succeeds.
A failed check never discards your credentials. They are stored first and checked second, deliberately: a network problem on our side must not cost you a credential you have already generated. If the check does not succeed, the tile reports that the credentials were saved but not yet confirmed, and you can correct the details without going back to Salesforce Marketing Cloud to issue a new one.
Where your credentials are sent
The auth subdomain host you enter is restricted to a .marketingcloudapis.com address. That restriction is a security control, not a convenience: the verification call sends your client secret to the host you type, so accepting an arbitrary hostname would make this form a way to have License Logic deliver your secret to somewhere it should not go. If you paste a host outside that domain, the connection is refused before anything is sent.
Access control
- Settings: Edit is required to connect or disconnect
- Integrations: View is required to see the Integrations page and connection status
- All endpoints are authenticated through your License Logic session
Data retention
Credentials are retained until you disconnect, at which point they are deleted from the database outright rather than disabled behind a flag.
Deleting the Installed Package or rotating its Client Secret stops the connection immediately, whether or not you also disconnect in License Logic. Doing both is the complete removal.
For more about License Logic’s security practices, see our Security Policy or contact security@licenselogic.co.
Troubleshooting
“Credentials saved, verification pending”
The credentials were stored but the token request did not succeed. In order of likelihood:
- The authentication host is wrong. It must be the Authentication Base URI from the API Integration component, not your Marketing Cloud login URL and not a REST or SOAP base URI. It ends
.auth.marketingcloudapis.com - The integration is not server-to-server. A web or public app integration authenticates differently and will not work here
- The Client Secret was truncated, or was rotated after you copied it
- The component has no read permissions selected
Your credentials are stored either way, so you can correct the Marketing Cloud side and reconnect without creating a new package.
“Auth subdomain host should be your own .marketingcloudapis.com host”
The host you entered is outside .marketingcloudapis.com. Copy the Authentication Base URI from the API Integration component, and enter the hostname only — no https://, no trailing slash, no /v2/token.
We have several business units and are not sure which one we connected
If you left the MID blank, the connection is scoped to the business unit that created the Installed Package. Disconnect, find your MID at Setup → Account Settings, and reconnect with it. This is worth resolving now rather than after the sync ships, because nothing will draw attention to it later.
Connected, but no data has appeared yet
Your first sync is scheduled once your connection is confirmed, so data appears shortly after rather than the instant you click Connect. If the tile shows the connection as verified, the credential side is done. If nothing has appeared after your first scheduled sync, contact support and we will look at the run.
The Connect button does nothing, or the tile is missing
This is almost always permissions on the License Logic side. Integrations: View shows the page; Settings: Edit is required to connect. Ask your License Logic administrator to check both in People → Roles.
Frequently Asked Questions
Why is Marketing Cloud a separate connection from Salesforce?
Because it authenticates separately. Marketing Cloud Engagement uses an Installed Package against marketingcloudapis.com, while Salesforce core uses a connected app against your org. They are different products with different credentials, so they are stored as two independent connections.
Do we have to provide the Business Unit ID?
The API does not require it, but if you have more than one business unit you should provide it. Salesforce’s documentation states that without it the token is issued in the context of the business unit that created the integration — so the result is narrower than you would expect, with nothing to indicate it.
Does License Logic receive a Marketing Cloud user’s password?
No. The connection uses an Installed Package’s Client ID and Client Secret, which are application credentials. They cannot be used to sign in as a person.
Can License Logic change anything in Marketing Cloud?
No. The integration reads seat and user information. It does not create, edit or delete journeys, data extensions, subscribers, users or settings. Today it does not read anything at all.
Can we remove the API Integration component later?
No — Salesforce’s documentation states a component cannot be removed from an installed package once added. To remove the integration, delete the package.
What happens if we disconnect?
The stored credentials are deleted from License Logic, and any Salesforce Marketing Cloud data already synced is removed with it. Your Salesforce Marketing Cloud account itself is untouched — the connected app remains valid there until you revoke it.
Support
If you need help with the Salesforce Marketing Cloud integration:
- Email: support@licenselogic.co
- In-app chat: click the chat icon in the bottom-right corner of License Logic
- Security questions: security@licenselogic.co
When contacting support, please include your company name, your authentication host and, if you have several, your Business Unit ID, and a description of the issue. Never send a credential by email — if we need to look at a connection, we can do so from our side.
If you would like to be told when the sync for this integration is enabled, say so and we will add you to the notification list for it.