When installing Campaign Monitor for Salesforce, you are prompted to choose which Salesforce users will get access. Later, if necessary, you can grant access to additional individuals via permission sets. You can also assign limited Campaign Monitor access to Salesforce users. 

Permission Sets

Campaign Monitor for Salesforce contains two permission sets in Salesforce. These permission sets allow users to access the application in Salesforce.

  • Campaign Monitor - Full Access - this permission set provides access to all parts of the Campaign Monitor for Salesforce application. Typically this is the Salesforce administrator.  
  • Campaign Monitor - User Access - this permission set provides user level access to the Campaign Monitor for Salesforce application.
If a user does not have access to either of these permission sets, then Campaign Monitor for Salesforce application will not be available to them. This means any rules, process builder actions will not be invoked when the Salesforce user makes changes to the Contacts, Leads etc.

To grant a permission set to a user:

  1. In Salesforce, click SetupManage UsersPermission Sets
  2. Select either Campaign Monitor - Full Access or Campaign Monitor - User Access
  3. Click Manage Assignment. From here you can choose which users to add to the permission set.

Restricting Access on the Campaign Monitor Tab

The Campaign Monitor tab allows you to access Campaign Monitor as if you logged into the application directly.  If you connect a Campaign Monitor administrator account to Salesforce, by default all Salesforce users given access to Campaign Monitor for Salesforce will also access that account.  The connected user can be found in sync settings tab within our general settings tab.To restrict access to certain features in Campaign Monitor, you can assign a non-admin Campaign Monitor account to a Salesforce user.First, you will need to add the "Campaign Monitor User" field to the Salesforce user page layout. This only needs to be done once:

  1. In Salesforce, click Setup near the top right of the screen.
  2. On the left in the "Quick Find" search box type manage users
  3. Below "Manage Users", click Users
  4. Select a Salesforce user.
  5. Near the top right, click Edit Layout.
  6. Drag and drop the Campaign Monitor User field into your layout, then click Save.

After the Salesforce user page layout has been modified:

  1. Select the Salesforce user you want to limit access to Campaign Monitor for, then click Edit.
  2. Next to "Campaign Monitor User", enter a Campaign Monitor non-admin account email address.
  3. Click Save.

NB. The "Campaign Monitor User" field also impacts various parts of the application when restricting what lists a user can see. If you are unable to see a subscriber list, check this value is correct. I.e. the user you have entered is valid in Campaign Monitor. 

Restricting Record Access within Salesforce

When the main sync runs, the Salesforce owner for records created by the sync will be set to the Salesforce user who connected Salesforce with Campaign Monitor (you can see the connected user in Salesforce under Setup-->Scheduled Jobs. It is listed under the Submitted By value for the schedule sendItScheduleSubscriptions).

 The Salesforce record owner can be changed by entering a Salesforce username under the field named Salesforce User on the Campaign Monitor Client Detail record.

 The owner for the following Salesforce records will be changed:

  1. Subscriber List
  2. Subscriber List Member
  3. Email Tracking History
When this is set, only records going forward will be owned by that user. To retrospectively set the owner on the Salesforce records, use the Reset Data option for both Subscriber list members and Email tracking data

Site User Permissions and Transactional Emails

Updating site user security settings is an advanced topic and requires a deep understanding of Salesforce security. See: Public Access Settings for Sites

Incorrect setup site user security settings is a common cause for Automatic Subscriptions/Subscriber rules for not firing where the contacts or leads are being created from an external website.

The Salesforce site user runs under slightly different permissions than an internal Salesforce user. If you are using the process builder with transactional emails or directly calling into sites from an external website, then you may need to perform the following steps (please follow carefully as these Salesforce site settings are hard to find):

  1. In Salesforce Classic, navigate to Setup--> Develop --> Sites,
  2. Click on the value under the Site Label (i.e. the name you gave to the site)
  3. Click on the button Public Access Settings (at the top of the page). This will open the profile for the site user.
  4. Click on the button  Assigned Users (sometimes called 'View Users').
  5. Click on the Full Name (i.e. the name under the label - something like Site Guest User).
  6. Permission Set Assignments --> Edit Assignments and add Campaign Monitor - User Access
  7. This assigns the Campaign Monitor for Salesforce related objects (E.g. Queue Items).

If your code or transactional setup also writes to other Salesforce objects then the sharing settings need be enabled for external access to the root object that is used by any transactional emails or your code (E.g. Opportunity, Account, Contact etc  - check Campaign Monitor Admin --> General Settings --> Maintenance logs for any permission messages):

  1. Navigate to Security Controls --> Sharing Settings --> Edit
  2. E.g. Set Default Internal Access and Default External Access to Public Read Only (for Contact, you typically need to this at the Account level).
If  you have enabled tasks with transactional emails, you may also need to set the sharing settings for tasks (i.e. Activity) to Controlled by Parent
 If you are not comfortable with setting up security for sites, then you could also consider having sites create or update the contact or lead in Salesforce, and then use our Import Wizard to perform the sync into Campaign Monitor. The Import Wizard typically runs under a different Salesforce user which may have more permissions, but the permission is not exposed to Salesforce sites. The only downside to the approach is that the Import Wizard can only be scheduled to run hourly.

In this article

Was this article helpful?

Thank you. Your feedback has been received!
Oops! Something went wrong while submitting the form.

If you’d like a member of our support team to respond to you, please email

Was this article helpful?

Thank you. Your feedback has been received!
Oops! Something went wrong while submitting the form.

If you’d like a member of our support team to respond to you, please email

Was this article helpful?

Thank you. Your feedback has been received!
Oops! Something went wrong while submitting the form.

If you’d like a member of our support team to respond to you, please email

© 2017 Beaufort 12 Limited is a company registered in England and Wales with company number 8174703
Privacy Policy | Terms & Conditions | Cancellation Policy