Marketo roles and what marketers should be able to touch

How access works in Marketo

Three things decide what a Marketo user can do: whether they have a seat at all, which roles they hold and which workspaces those roles apply in. Seats come from the Adobe Admin Console, where a user is added to a product profile. Adobe’s documentation notes that a user added that way is granted the Standard User role in the Default workspace and that any adjustment to their role within the workspace happens in Marketo under Admin, then Users & Roles.

Roles are where the permissions live. Each role is a list of ticked boxes and a user gets the union of whatever their roles allow, with one catch covered below. Eloqua does the same job with security groups which have a guide of their own.

The six built-in roles

Marketo ships with six:

• Admin and Adobe Product Admin have access to the whole application, including the Admin area. Adobe says you “cannot delete the Admin or Adobe Product Admin roles.”
• Standard User and Marketing User have access to everything except the Admin area.
• Web Designer works only in the Design Studio.
• Analytics User works only in the Analytics section.

The four non-admin roles can be edited or deleted. Most teams that let marketers in build a custom role instead, because Standard User and Marketing User can do almost everything a full Marketo user can, which is more than a part-time marketer needs.

Custom roles and the permission list

A custom role is created under Admin, Users & Roles, on the Roles tab, by naming it and ticking permissions. Adobe’s role steps add two things worth knowing: editing a role changes it for every user who holds it and a role can’t be deleted while anyone is assigned to it.

The list of permissions is long and grouped by area. Each area starts with an Access permission that opens that part of the application and the finer permissions under it only work when the parent is ticked. Adobe’s example: to grant Edit Campaigns you must also grant Access Marketing Activities. Users may also see assets and actions their role doesn’t cover and get a warning about limited access when they try to open them.

The permissions that matter most when a marketer is getting access:

• Under Access Marketing Activities: Edit Marketing Asset, Clone Marketing Asset and Delete Marketing Asset, Approve Email Program, Schedule Batch Campaign, Activate Trigger Campaign, Edit Campaign Restrictions, List Import and Import Program.
• Under Access Database: Import List, Create List and Delete List, Edit Person, Delete Person, Export Person, Merge People and Run Single Flow Actions.
• Under Access Design Studio: for each asset type, Access, Edit, Approve and Delete. Email, Email Template, Landing Page, Landing Page Template, Form, Snippet and Image each have their own set and the new Email Designer’s AI Assistant has its own Access AI Assistant permission here too.
• Under Access Admin: Access Users, Access Roles, Access Field Management, Access Workspaces and Partitions and Access Smart Campaign which controls the limits on how many people a smart campaign may affect.
• Under Access Analytics: the reports and Email Insights, with Create Report, Delete Report and Export Analytics Data underneath.

The split between Edit and Approve is the most useful tool in the list. A role that can edit emails but not approve them can build all day and send nothing which is how a one-step review is enforced in Marketo. The email approval guide covers what that review does and doesn’t catch.

Roles and workspaces

A role is granted in a workspace so a regional marketer can be a Marketing User in the EMEA workspace and nothing elsewhere, while a central Ops user is an Admin everywhere. Two permissions exist for this setup, Admin access for a specific Workspace and Move assets between Workspaces. The workspaces and partitions guide covers how regions are separated.

Inside a workspace there is no finer boundary. Marketo doesn’t offer folder-level permissions, as Adobe’s community answers confirm, and a feature request for them is open. A user who can edit marketing assets can edit any program in the workspace, including the ones that belong to another team.

One role per user

It is natural to give a user two roles, say a general marketer role plus a narrower one for approvals and expect the permissions to add up. Adobe’s knowledge base warns that “Marketo will, more often than not, be more restrictive” when roles conflict and gives the example of a user whose roles disagree about approving emails: “Marketo may restrict the User from being able to approve the email asset.” Adobe’s own role page says the same: “If you leave multiple roles selected, Marketo will default to the most restrictive permission.” The recommendation is “that Users are invited with only one role assigned,” built for their job.

What a sensible marketer role looks like

Teams that let marketers into Marketo usually end up with a custom role along these lines, granted in one workspace:

• Access Marketing Activities with Edit Marketing Asset and Clone Marketing Asset and nothing that activates or schedules.
• Access Design Studio with Access Email and Edit Email only. No Approve Email, no templates, no snippets.
• No Access Database, or Access Database with nothing under it so no Import List and no Delete Person.
• Access Analytics so they can read their own reports.
• No Access Admin.

Then log in as a user with that role and try to do the things you meant to prevent. Repeat whenever the role changes, because the change affects everyone who holds it.

What roles leave to you

A role built like that is a real improvement and it still leaves Ops exposed, because a role answers the question “may this person open this?” and every policy Ops cares about is about what happens next.

Edit means edit all of it

A user with Edit Email can change any part of an email the template leaves open which in an ordinary template is most of it. Keeping the logo, the footer and the layout fixed is a job for content locking in the template, configured separately for every template the marketer can reach.

A smart list is the whole database

A marketer who can edit a program’s smart list can point it at anyone in the workspace’s partitions. Nothing in the role says “only the people who registered for this event.” The all-leads mistake is a permission away.

Import is yes or no

Import List grants the wizard and says nothing about what goes through it. Block Field Updates can protect individual fields and that is worth doing but nothing in the role checks that a country column holds countries or that consent came along. The list import guide goes through what the import does and doesn’t check.

Approve is a single permission

Withholding Approve Email forces a second person to look. It doesn’t tell that person a draft is waiting, doesn’t record what the marketer asked for, doesn’t route a regional email to the regional manager and doesn’t stop the reviewer approving their own work if they have both permissions.

Roles drift

A permission added for one urgent campaign stays. A second role gets added and the restrictive one wins in ways nobody predicted. A new feature arrives with its own permission that nobody reviews. The careful role you built in the spring is a different role by winter and the only way to know is to log in as a member and look.

Every marketer is a trained user

Whatever the role allows, the person holding it is working in Marketo. They need to know what a smart list is, why an email has to be approved, what a flow step does. The cost of self-service through roles is training every marketer to be a careful junior Marketo user and keeping them that way through staff turnover and releases.

Access by wizard instead of by role

Campaign Launchpad changes what the question is. Marketers don’t get Marketo logins. They get a Launchpad login and a set of wizards that Marketing Ops built for the campaigns they are allowed to run.

Each wizard is a permission set of its own, defined in terms a marketer understands rather than in asset types and permission names. Ops chooses:

• Which templates the wizard offers and which zones in them can be edited.
• Which audiences can be chosen from the lists Ops set up, whether a file can be uploaded and what it has to pass.
• Which fields the marketer fills in and the options for each.
• Which settings are visible at all. Sender, program settings, send window and tracking can be fixed by Ops and never shown.
• Who approves the result and how many levels of approval it needs.

Everything else in the instance is unreachable from the wizard. There is no smart list to repoint, no template library beyond the ones offered and no import wizard to confirm a bad mapping in. A new marketer can run their first campaign on their first day without training because there is nothing on the screen that it would be wrong to click. Ops keeps its own roles for its own work, the wizards run under them and one Launchpad account can sit in front of any number of Marketo and Eloqua instances. When a campaign needs something no wizard allows, Launchpad hands that step to Ops with the request attached rather than widening anyone’s role.