Support Center  | Administration | Permissions


  • Use predefined permission sets to control access to Campaign Monitor for Salesforce.

  • Restrict what access users are able to do within the Campaign Monitor application.

  • Define the data users see in Salesforce via sharing rules and client configuration.

For most companies the only thing you will need to do is to assign one of our two permission sets to allow Salesforce users to work with our application. To make things as easy as possible we have provided two permission sets.  The standard permission set allows a user to see our application, the full permission set gives an additional settings tab.  When you first install the application only system administrators will have access, permission sets can then be assigned to Salesforce users.

Campaign Monitor for Salesforce includes custom objects to store Campaign Monitor data in Salesforce records.  It also has a tab called Campaign Monitor which allows a person to access  Campaign Monitor without leaving Salesforce.  The Campaign Monitor tab will connect/display as the Campaign Monitor user used to initially connect the two systems. The Campaign Monitor connecting user can be found on the General Settings tab within the Sync page.  

Again for most companies all Salesforce users are allowed to access Campaign Monitor without restriction.  But if you want to change that so one or more Salesforce users see a restricted view then please review this section.

Finally records stored within our custom objects obey standard Salesforce security and ownership rules. If you want a Salesforce user to have access to our application but want control the records they see please check out this section.

Add a permission Set

There are two types of permission set. Standard access which give a user access to all features excluding settings. Full access which gives a user to access to settings as well as all features.

  1. In Salesforce go to the Campaign Monitor Admin App

  2. Click on the General Settings tab.

  3. Then select User Security.

  4. Select or search and select for the user(s) you want to assign the permission set to.

  5. Click the Edit Permissions button.

  6. Select the Standard or Full Access option and click Assign Permission Set

Click to play

Removing a permission set

  1. In Salesforce go to the Campaign Monitor Admin App

  2. Click on the General Settings tab.

  3. Then select User Security.

  4. Select or search and select for the user(s) you want to assign the permission set to.

  5. Click the Edit Permissions button.

  6. Select the None and click Assign Permission Set

Click to play

If a user does not have access to either permission set then automation will not be triggered. So for example if a record is updated by a user who does not have a permission set our products triggers will not fire.

Access to the Campaign Monitor Tab

The Campaign Monitor tab allows you to access Campaign Monitor as if you logged into the application directly (I.e. single sign on).

Salesforce users who have access to the tab will view it as the connected user which can be found via sync settings within our general settings tab. If you’d prefer a Salesforce user has a restricted view you can set an override user in Salesforce for that person.  
An override user is another Campaign Monitor user that has a different access to the connected user.  It is worth noting that you can link Salesforce users to the same user in Campaign Monitor. This avoids the need to setup lots of Campaign Monitor users.  In the context of the integration think of a Campaign Monitor user as a Salesforce profile.

Direct Campaign Monitor Account
This is the most common type of Campaign Monitor account. The account can have one or more users that can be linked to a Salesforce user to restrict what they can do in Campaign Monitor. See the section below on adding an override user.

Agency Campaign Monitor Account
Some customer will either be part of a marketing agency or a large company that uses this style of account. An Agency account allows a company to have a parent Campaign Monitor client and linked sub clients beneath. In this case you may want to limit Salesforce users to a particular Campaign Monitor client and/or with limited permissions. Campaign Monitor security model is quite different to Salesforce in terms of the integration you can think of a Campaign Monitor user more like a Salesforce profile. So it is possible to create one Campaign user that has access to a client with either full, standard or custom permissions and link it to many Salesforce users.

If you are using an Agency account you may notice that when you use the "Link Campaign Monitor User" button, the available users will not show Campaign Monitor Admin users. When in an Agency account, you can have multiple top level Administrators. However when setting the security in Campaign Monitor for Salesforce, you can only select the Administrator that is used for connecting Salesforce to Campaign Monitor.

The ideal setup is to have Campaign Monitor users created for each client in the agency that you need access to. Simply use the same email address when creating those users. They will then appear when using linking Campaign Monitor users to Salesforce users.

Adding the override user

  1. In Salesforce go to the Campaign Monitor Admin App

  2. Click on the General Settings tab.

  3. Then select User Security.

  4. Select or search and select for the user(s) you want to assign the permission set to.

  5. Click the Link Campaign Monitor User button.

  6. Select the Campaign Monitor Client

  7. Select the Campaign Monitor User, if you don't have a user you can create one by clicking Create New Campaign Monitor User (if you don't see the Campaign Monitor user, check a) they have the "Limit account access" checkbox checked (along with the extra permissions they need), b) they are not an admin user (if using an Agency account).

  8. If you have selected a Campaign Monitor User or created a new one you just need to click the Link User buttong.

Click to play

Records created within Salesforce are controlled by the Campaign Monitor Client record. Adding a Salesforce user will assign the client and all related records.  This enables you to use Salesforce security controls to make records private or make visible to a group with sharing rules.

Restricting Record Access within Salesforce

When the primary sync runs, the Salesforce owner for records created by the sync will be set to the connected user, you can see who this is via the General Settings Tab under sync settings.

The Salesforce record owner can be changed by going to a Campaign Monitor client record (usually there is only one but if you have sub clients in Campaign Monitor there will be many) and entering a Salesforce username under the field named Salesforce User. This will then update the ownership of the Campaign Monitor Client record and going forward will update related records:

  1. Subscriber List

  2. Subscriber List Member

  3. Email Tracking History

If you would like this change to affect all related records the you need to perform a rest for both Subscriber List Members and Email Tracking Data.

Salesforce Site User

The Salesforce site user runs using different permissions to an normal Salesforce user. If you are using the process builder with transactional emails or directly calling into sites from an external website, then you may need to perform the following steps:

  1. Click Setup

  2. In the search box type in Sites and then click on Sites

  3. Click on the value under the Site Label (i.e. the name you gave to the site)

  4. Click on the button Public Access Settings (at the top of the page). This will open the profile for the site user.

  5. Click on the button  Assigned Users (sometimes called 'View Users').

  6. Click on the Full Name (i.e. the name under the label - something like Site Guest User).

  7. Permission Set Assignments --> Edit Assignments and add Campaign Monitor - User Access

  8. This assigns the Campaign Monitor for Salesforce related objects (E.g. Queue Items).

Updating site user security settings is an advanced topic and requires a deep understanding of Salesforce security. See: Public Access Settings for Sites

Incorrect setup site user security settings is a common cause for Automatic Subscriptions / Subscriber rules for not firing where the contacts or leads are being created via an external website.

If your code or transactional setup also writes to other Salesforce objects then the sharing settings need be enabled for external access to the root object that is used by any transactional emails or your code (E.g. Opportunity, Account, Contact etc  - check Campaign Monitor Admin --> General Settings --> Maintenance logs for any permission messages):

  1. Navigate to Security Controls --> Sharing Settings --> Edit

  2. E.g. Set Default Internal Access and Default External Access to Public Read Only (for Contact, you typically need to this at the Account level).

    If you have enabled tasks with transactional emails, you may also need to set the sharing settings for tasks (i.e. Activity) to Controlled by Parent.

    If you are not comfortable with setting up security for sites, then you could also consider having sites create or update the contact or lead in Salesforce, and then use our Import Wizard to perform the sync into Campaign Monitor.

    The Import Wizard typically runs under a different Salesforce user which may have more permissions, but the permission is not exposed to Salesforce sites. The only downside to the approach is that the Import Wizard can only be scheduled to run hourly.

Was this article helpful?

Thank you. Your feedback has been received!
Oops! Something went wrong while submitting the form.

If you have any questions please click here

© 2017 Beaufort 12 Limited is a company registered in England and Wales with company number 8174703
Privacy Policy | Terms & Conditions | Cancellation Policy