Eloqua security groups and what marketers should be able to touch

Six layers of access

Oracle’s security groups are how an administrator “can manage and control the access rights and permissions that other users of the Eloqua application at your organization can access, modify, create, and configure.” A user belongs to one or more groups and each group carries six sets of settings. Oracle recommends configuring them in this order when you create a group. Marketo does the same job with roles and they have a guide of their own.

Licensing

Licenses decide which products a user can reach at all. The Marketing Platform license is the core one; without it a user who logs in “will only have access to their user profile.” Reporting (Insight), Analyzer, Engage, Profiler, Customer Administrator and Sales Tools for Outlook are separate. How many of each you have depends on the trim you bought and every marketer who sends for themselves uses one.

Interface access

Interface access “determines the pages of Oracle Eloqua that a user can access.” Campaigns, Assets, Audience, Insight, the settings areas and the approvals screen are each a check box. A user with no access to a page doesn’t see it in the navigation.

Action permissions

Action permissions control “the commands users have access to while in an area of the Oracle Eloqua interface.” The full list runs to well over a hundred. The ones that matter most when a marketer is getting access include:

• Upload Contact/Prospects/Companies which allows the Contact Upload Wizard and Manage Data Import for the import tool.
• Send Email To Globally Unsubscribed Contacts and Send Email To Contacts On Master Exclude List.
• Manage Contacts and Delete a Contact Record.
• Create an Email Group, Manage Templates and Manage Blocks.
• View Operational Reports which shows the reports tab on campaigns, programs and editors.
• Use Generative AI Features, once Oracle has enabled generative AI on the instance.
• Manage Run as User which lets a user run a campaign as someone else and so under someone else’s contact security labels.

Asset creation

Asset creation is a list of check boxes, one per asset type: emails, landing pages, forms, segments, campaigns and so on. Oracle notes that when you set up a group “none of the assets are selected by default” and that for any type left unchecked “that functionality is removed from the application for members in that group.” It is the simplest and most useful of the six. A group that can’t create segments can only send to segments someone else built.

Default asset permissions

Every asset in Eloqua carries four permissions: View, Edit, Delete and Set Security. A group’s defaults decide what permissions a new asset gets when a member creates it and who else gets them. Anyone with Set Security on an asset can override the defaults for that asset alone which is how a template or a master segment is kept read-only for everyone but Ops.

Two things catch people. Permissions are cumulative: “if you are a member of multiple security groups, the cumulative permissions are assigned to the asset,” so a marketer in a careful new group and a generous old one gets the generous one. And the Campaigns tab of the defaults holds the Activate permission that decides whether a user can launch a campaign without going through campaign approvals.

Business unit membership

Business units let administrators “support separate brands, divisions, and lines of business by categorizing users based on their business unit.” Members get access to the assets and data in their unit. It is the Eloqua answer to one instance shared by several brands and it pairs with contact security below. The regional teams guide goes into how the two are used together.

Contact security

Everything above is about assets and features. Contact security is about the database. Oracle also calls it label-based access control. You define label categories such as region or division, assign labels to security groups and build a program on the canvas that assigns labels to contacts as they arrive. After that “security group members can then only access contacts that have the same labels as their security group.”

The consequences run through everything a marketer does. Segment counts “could be different between different users” because each sees only their contacts. A campaign “inherits the labels of the user who activates it,” so only contacts that user can see enter it. Contact reports in Insight are filtered the same way, though dashboards aren’t. Oracle recommends starting with two or three categories at most and giving the administrator group every label so somebody can still see the whole database.

It is included in the Standard and Enterprise trims and needs administrator rights to set up.

What a sensible marketer group looks like

Most teams that let marketers send end up building a custom group along these lines:

• Marketing Platform and Reporting licenses, no Analyzer.
• Interface access to Campaigns, Assets and Audience, nothing under Settings.
• Asset creation for campaigns and emails only. No segments, no forms, no landing pages, no email groups.
• Default asset permissions that give the group View on shared templates and segments, Edit and Delete only on what its members create and no Set Security anywhere.
• No Activate permission so campaigns go through approvals.
• Action permissions that leave out uploads, sending to unsubscribed or excluded contacts, deleting contacts and running campaigns as another user.
• Contact security labels for the marketer’s region or brand.

Oracle’s own advice for checking the result is to log in as a user who only has rights to this group and try to do the things you meant to prevent. Do that every time the group changes.

What permissions leave to you

A group built like that is a real improvement and it still leaves Ops exposed, because permissions answer the question “may this person open this?” and every policy Ops cares about is a question about what happens next.

Edit means edit all of it

A marketer with Edit on an email can change any part of it: the logo, the footer, the unsubscribe link, the sender name. Permissions have no notion of “edit the headline but not the layout.” That needs protected templates and locked blocks, configured separately, on every template the marketer can reach.

Access to segments is access to the database

A marketer who can choose a segment can choose any segment they can see and the one named All Active Contacts is usually among them. Contact security narrows the pool to a region. It doesn’t stop a regional marketer sending a product announcement to every contact in the region whether or not they asked about that product.

Upload is yes or no

The upload permission grants the wizard and says nothing about what goes through it. There is no permission for “upload files whose country column uses ISO codes” or “never overwrite the CRM-owned fields.” Once a user can upload, what arrives in your database is whatever they confirm on the mapping screen.

Every group is a maintenance job

Groups drift. A permission added for one urgent campaign stays. A user added to a second group inherits its permissions. A new feature such as generative AI arrives with its own permission that nobody reviews. The careful group you built in the spring is a different group by winter and the only way to know is to log in as a member and look.

Every marketer is a trained user

Whatever the group allows the person in it is working in Eloqua. They need to know what a segment is, what an email group does, what the review step is telling them. The cost of self-service through permissions is training every marketer to be a careful junior Eloqua user and keeping them that way through staff turnover and product releases.

Access by wizard instead of by group

Campaign Launchpad changes what the question is. Marketers don’t get Eloqua or Marketo logins. They get a Launchpad login and a set of wizards that Marketing Ops built for the campaigns they are allowed to run.

Each wizard is a permission set of its own, defined in terms a marketer understands rather than in asset types and action names. Ops chooses:

• Which templates the wizard offers and which zones in them can be edited.
• Which audiences can be chosen from the lists Ops set up, whether a file can be uploaded and what it has to look like.
• Which fields the marketer fills in, such as region, product or business unit and the options for each.
• Which settings are visible at all. Sender, email group, send window and tracking can be fixed by Ops and never shown.
• Who approves the result and how many levels of approval it needs.

Everything else in the instance is unreachable from the wizard. There is no segment picker to scroll past the all-contacts segment, no advanced sending options, no template library beyond the ones offered and no contact database to open. A new marketer can run their first campaign on their first day without training because there is nothing on the screen that it would be wrong to click.

Ops keeps its own security groups and roles for its own work and the wizards run under them. One Launchpad account can sit in front of any number of Eloqua and Marketo instances so the same marketer-facing rules can apply across all of them while each instance keeps its own configuration. When a campaign needs something no wizard allows, Launchpad hands that step to Ops with the request attached rather than widening anyone’s permissions.