Connect Salesforce Marketing Cloud
You create an installed package in Marketing Cloud, give it four read scopes, and paste its Client ID, Client Secret and subdomain into MarqIQ. MarqIQ then reads your subscribers, your sends, your journeys and your Content Builder pages, and writes nothing back to any subscriber. If you want to know what you are granting before you start, read How connecting a tool works.
Before you start
Permissions required
You need a Marketing Cloud user who can create an installed package under Setup. MarqIQ signs in as the package itself, not as you, so what it can read is decided entirely by the scopes you tick on the package — not by your own user.
Plan required
Connecting needs Pro or above. On Starter the connect request is refused with "Salesforce Marketing Cloud is part of the Pro plan — this workspace is on Starter." A Free Trial workspace has the Pro feature set, so it can connect.
One marketing automation tool on Pro
Pro includes two connected tools besides Google Tag Manager, and one from each category. Marketing Cloud sits in marketing automation, so if Marketo, Account Engagement, Mailchimp, Adobe Campaign or Adobe Journey Optimizer is already connected, Pro refuses this one and names the tool holding the slot. Business and above allow more than one from the same category.
- The package Client ID.
- The package Client Secret. It is shown in Marketing Cloud, not sent to you.
- Your account subdomain — the token in front of `.auth.marketingcloudapis.com` in your authentication URL.
Create the installed package in Marketing Cloud
MarqIQ uses the server-to-server flow, so there is no sign-in window and no consent screen. The package is the credential.
In Marketing Cloud, go to Setup → Platform Tools → Apps → Installed Packages.
That path is inside your own account, so MarqIQ cannot link you straight to it. Salesforce documents the whole flow at developer.salesforce.com/docs/marketing/marketing-cloud/guide/access-token-s2s.html
Create a new package.
Add an API Integration component to it.
Choose Server-to-Server as the integration type.
A Web App or Public App component issues a user token that expires and needs a browser to renew. MarqIQ holds no browser session, so only Server-to-Server works here.
Grant the package four read scopes.
Each one turns on a different part of MarqIQ. The connection itself succeeds without them, because the check at connect time reads only the account configuration — a missing scope shows up the first time the feature that needs it runs.
- Contacts read — your contact attributes, which is what UTM Field Validation lists.
- List and Subscribers read — the subscriber sync. Without it nothing comes across at all.
- Journeys read — journeys in the Automations analysis and in the Audit Report.
- Saved Content read — Content Builder pages in the Audit Report, and pushing an email template from Template Studio.
Copy the Client ID.
Copy the Client Secret.
Copy the subdomain from the package authentication URL.
It is the token in front of the host: from `mc563885gzs27c5t9-63k636ttgm.auth.marketingcloudapis.com` the subdomain is `mc563885gzs27c5t9-63k636ttgm`.
Pasting the whole host, or the whole URL with https:// on the front, is fine. MarqIQ trims it to the token itself and lowercases it before it saves anything.
Connect it in MarqIQ
Open Connected Tools in MarqIQ and click the Salesforce Marketing Cloud card.
The page is headed Integrations, and Marketing Cloud sits under the Marketing Automation heading.
Paste the package id into Client ID.
Paste the package secret into Client Secret.
Paste your subdomain into Subdomain.
Click Connect SFMC.
MarqIQ asks Marketing Cloud for a token with your credentials, then calls `platform/v1/configcontext` with that token to check REST access works. All three values are saved only when both steps succeed, so a bad secret fails here rather than at the first sync.
If Marketing Cloud is already connected the button reads Update credentials instead. Use it to rotate a secret without losing your field mappings.
Check Subdomain and Timezone on the connection card.
MarqIQ reads the timezone back from your account when you connect and shows it beside the subdomain. Marketing Cloud reports SOAP dates in that timezone, so read it before you read any date in MarqIQ.
Leave the tab open while the first sync runs.
Connecting starts the sync on its own. The status line says "keep this tab open" while it runs. Close the tab and the run stops where it is; the next run carries on from the saved position.
Read the result line.
A first load finishes with "Fully synced — N records". Later runs say "Up to date — N changes since your last sync". Compare N against your All Subscribers count in Marketing Cloud.
Note
The very first sync in a new workspace can report that the workspace's database is still being created. MarqIQ waits and retries on its own. If it gives up, wait a few minutes and click Sync now.
What comes across
- Subscribers, keyed on Subscriber Key and falling back to the subscriber ID when there is no key.
- Email address, first name, last name, company and job title, read from your profile attributes under their own names.
- Subscriber status, email type preference, created date and unsubscribed date.
- Every other subscriber property and profile attribute your account defines. MarqIQ runs a Describe on the Subscriber object each run and asks for everything Marketing Cloud reports as retrievable, so an attribute your team added last month arrives without anyone listing it here.
- The full attribute list is saved as your field catalogue, which is what the field-level analyses read.
Nested properties and platform bookkeeping are left out of the request on purpose, because a Retrieve that names them fails or returns nothing usable: Lists, Attributes, Client, Owner, Addresses, Locale, ModifiedDate and a handful of others.
An attribute Marketing Cloud refuses
Describe sometimes offers a property that a Retrieve then rejects. MarqIQ finds which one by halving the list and probing, drops only that property, and names it in the run notes: "Marketing Cloud refused these subscriber attributes on retrieve and they were skipped". One bad attribute never costs you the rest.
The Subscriber object has no modified date
An incremental run can only ask Marketing Cloud what was created since the last run and what unsubscribed since it. A profile attribute edited in place on an older subscriber is invisible to both. MarqIQ re-reads the whole list in full every seven days to close that gap, and says so in the run notes: "Weekly full re-walk: Marketing Cloud cannot report subscribers edited in place, so the whole list is re-read." Click Sync now with a full run if you cannot wait for it.
Note
Marketing Cloud has no deleted-subscribers feed. A subscriber deleted in Marketing Cloud stays in MarqIQ until a full resync, and the sync log says exactly that rather than guessing. Unsubscribes are recorded as status.
What the Audit Report reads
| Section | What Marketing Cloud gives it |
|---|---|
| Emails | Per-send counters from the Send object: sent, delivered, unique opens, unique clicks, unsubscribes, hard bounces and soft bounces, with a daily series and the ten largest sends. |
| Journeys | Journey Builder interactions, most recent version only, the first 200. Entry counts are not exposed by the interactions list, so none is shown. |
| Landing pages | Content Builder web pages, the first 200, with published or draft status and the page URL. Page views are not reported by Content Builder. |
| Forms | Nothing. Smart Capture form submissions are not exposed as a feed by the Marketing Cloud APIs. |
| Web visits | Nothing. Web visits are not reported by Marketing Cloud. |
| Deals | Nothing. Marketing Cloud has no deals or opportunities. |
Email totals cover the first 25,000 sends in the period, and the report says so when it hits that ceiling.
What connecting unlocks, and what it does not
- Email — one row per send, read from the Send object. Marketing Cloud is one of the four tools MarqIQ reads send results from, with HubSpot, Mailchimp and Marketo.
- Automations — your journeys, by name and published state.
- Overview, Source truth and Audience health — these run on the records themselves and need nothing extra.
- Field discipline — not available. Marketing Cloud exposes no per-field change history, so there is nothing to hold a field to.
- Forecast accuracy — not available. MarqIQ has no forecast reader for Marketing Cloud, and no deals sync from it.
- Form fills — MarqIQ cannot read Marketing Cloud's own forms, so fills here come from the tracking script on your website instead.
- Lead scoring and Funnel — MarqIQ has not verified how either works in Marketing Cloud. If your synced records hold a score field or a stage ladder the analysis runs on them; if they do not, MarqIQ says it has not checked rather than telling you your setup is wrong.
- Field Mapping, Template Studio and Audit Report are the three operations listed for Marketing Cloud on its operations page.
The UTM fields, and why *Create* is refused
MarqIQ tracks seventeen fields: nine under Most Recent UTM Fields and eight under First Touch UTM Fields. The UTM Field Validation section on the Marketing Cloud page shows which of them it can find among your contact attributes, counted against each group's own total — "9/9 fields found" for Most Recent, "8/8 fields found" for First Touch.
Create the attribute in Marketing Cloud yourself.
Go to Contact Builder → Data Designer, open your attribute group and add the attribute there. Marketing Cloud has no REST call that adds an attribute to an existing attribute group, so MarqIQ cannot do this for you — the same limit that applies to Salesforce and Dynamics.
Click Refresh on UTM Field Validation.
Click Map existing on the field that is still missing.
Type the Marketing Cloud attribute name into SFMC attribute name.
Click Save.
Tip
Name the attribute exactly as MarqIQ names the field and it is found without any mapping. The match ignores case and treats a space as an underscore, so an attribute called `UTM Source Most Recent` matches `utm_source_most_recent` on its own.
Neither Create button works on Marketing Cloud
The Create button on a single field and the Create N missing button on a group send the same request. Create shows you the Contact Builder path back. Create N missing throws every answer away, so the group reloads unchanged and no error appears. Make the attributes in Contact Builder and map them. On a workspace without a paid subscription both buttons are replaced by an upgrade link, which changes nothing here.
What MarqIQ writes back
- Nothing to your subscribers. No subscriber is created, changed, unsubscribed or deleted, on any plan.
- No attribute, attribute group or data extension is created. Every field mapping is held in MarqIQ.
- No journey is created, started, paused or edited. Journeys are read only.
- One thing only, and only when you ask for it: Template Studio can push an email you built into Content Builder as an `htmlemail` asset, with its editable regions marked up as slots and blocks.
- CloudPages landing pages are export-only. Marketing Cloud has no generally available creation API for them, so you copy the markup across yourself.
If it did not work
"Client ID, Client Secret, and Subdomain are required"
Why: One of the three boxes is empty, or holds only spaces.
Fix: Fill in all three and click Connect SFMC again. The secret is shown once in Marketing Cloud, so open the installed package and copy it from there rather than from a note.
"Subdomain must be the token in your Marketing Cloud auth URL, like mc563885gzs27c5t9-63k636ttgm from mc563885gzs27c5t9-63k636ttgm.auth.marketingcloudapis.com."
Why: What you pasted into Subdomain is not a Marketing Cloud tenant token. The commonest causes are pasting the MID, pasting a path rather than a host, or pasting a value with a character other than a letter, a digit or a hyphen in it.
Fix: Open the installed package in Marketing Cloud and copy the authentication URL. Paste either the whole host or the token in front of `.auth.marketingcloudapis.com`. It is between 4 and 64 characters long.
"Invalid credentials — could not obtain access token from Salesforce Marketing Cloud."
Why: Marketing Cloud refused the Client ID and Client Secret pair at the token step. Either one of them is wrong, or the component is not a Server-to-Server API Integration, or the package belongs to a different business unit from the subdomain you gave.
Fix: Check the component type in Installed Packages first, then copy the id and the secret again. Where Marketing Cloud answers with an explanation of its own rather than an outright refusal, MarqIQ shows Marketing Cloud's wording in place of this sentence — read it, because it names the fault.
"REST API verification failed (403). Check your subdomain."
Why: The token was issued, so the credentials are right, but the REST call that follows was refused. The subdomain usually belongs to a different tenant from the package.
Fix: Copy the subdomain from the same installed package that gave you the Client ID, and connect again. A 401 in place of the 403 means the token was rejected outright, which points at the package rather than the subdomain.
"Salesforce Marketing Cloud is part of the Pro plan — this workspace is on Starter."
Why: Marketing Cloud needs Pro or above. The card is visible on every plan, so the refusal arrives at the last step.
Fix: Move to Pro or above. A Free Trial workspace carries the Pro feature set, so it connects without an upgrade.
"Pro allows 1 tool from this category, and Marketo is already connected. Business and above allow more than one from the same category."
Why: Pro allows one tool per category. Marketing Cloud, Marketo, Pardot (MCAE), Mailchimp, Adobe Campaign and Adobe Journey Optimizer are all marketing automation, so the second one is refused and the first is named.
Fix: Disconnect the tool the message names, or move to Business or above. Reconnecting a tool you already have is never refused, so rotating a secret does not need a free slot.
"Pro includes 2 tools besides Google Tag Manager, and this workspace has connected 2 (…). Disconnect one, or move up a plan."
Why: Your plan's tool allowance is full. Google Tag Manager is exempt and never counts, and neither do the AI engine keys you add for AI answer visibility; every other connected tool does.
Fix: Disconnect one of the tools the message names, or move up a plan.
"This workspace is read-only. Renew the subscription to connect tools."
Why: The subscription has lapsed, or an administrator has set the workspace to read-only. A read-only workspace connects nothing new, whatever the plan allowed before.
Fix: Renew the subscription, then connect Marketing Cloud again.
UTM Field Validation shows an error ending "The installed package needs the Contacts read scope."
Why: MarqIQ asked Marketing Cloud for your contact attribute set definitions and was refused. The package has no Contacts read scope.
Fix: Add Contacts read to the API Integration component in Installed Packages, then click Refresh. Changing a scope does not change the Client ID or the secret, so there is nothing to paste again.
"Create the attribute in Marketing Cloud (Contact Builder → Data Designer → your attribute group → Add attribute), then map it here."
Why: This is not a fault. Marketing Cloud has no REST call that adds an attribute to an existing attribute group, so Create answers with the path to do it yourself.
Fix: Add the attribute in Contact Builder, click Refresh, then use Map existing to point the MarqIQ field at it.
The sync stops with 'Marketing Cloud rejected the token — check the installed package has the "List and Subscribers" read scope.'
Why: The subscriber walk runs over SOAP, and Marketing Cloud answered it with a 401 or 403. The connection is fine — the package cannot read subscribers.
Fix: Add List and Subscribers read to the package, then click Sync now. Nothing needs reconnecting.
The sync stops with "Marketing Cloud refused the installed package credentials … — reconnect the integration."
Why: The credentials no longer work. A secret was rotated in Marketing Cloud, or the package was deleted or disabled.
Fix: Open the installed package, copy the current Client ID and Client Secret, paste both into MarqIQ and click Update credentials.
"Marketing Cloud connection is incomplete — reconnect the integration."
Why: The stored credentials are missing the Client ID, the Client Secret or the subdomain, so the sync cannot even ask for a token.
Fix: Enter all three on the Marketing Cloud page and click Update credentials.
"Another sync is already running for this workspace — it will finish on its own."
Why: A scheduled run holds this workspace. One sync per tool runs at a time, by design.
Fix: Nothing. Your subscribers are being refreshed right now, which is why the message is shown in green rather than red.
A subscriber you edited in Marketing Cloud this morning still shows the old values
Why: The Subscriber object carries no modified date, so an incremental run cannot see an edit in place. It sees creations and unsubscribes only.
Fix: Wait for the weekly full re-walk, or run a full sync now. The re-walk re-reads every subscriber and overwrites what it finds, so running it twice costs nothing but time.
A run note lists attributes that "Marketing Cloud refused … on retrieve"
Why: Describe offered those properties and a Retrieve rejected them. They are skipped so that the rest of the attributes still sync.
Fix: Nothing, unless you need one of the named attributes. Check its definition in Contact Builder — a nested or collection attribute cannot be retrieved on Subscriber at all.
A run note says "Could not read the subscriber attribute list … only the core subscriber fields were synced this run."
Why: The Describe call on the Subscriber object failed, usually because the package lost a scope. MarqIQ carries on with the eight core properties: ID, SubscriberKey, EmailAddress, Status, EmailTypePreference, CreatedDate, UnsubscribedDate and Client.ID.
Fix: Check the package still has List and Subscribers read and Contacts read, then click Sync now. The first run whose Describe succeeds fills the other attributes in.
Create N missing finishes and the same fields are still missing
Why: Every create in the group is refused for the same reason a single Create is, and the group button discards each answer, so no message reaches the screen.
Fix: Add the attributes in Contact Builder → Data Designer, click Refresh, then point each field at its attribute with Map existing.
The Audit Report shows journeys as unavailable
Why: The journeys call was refused. The report says so directly and ends with "The installed package needs the Journeys read scope."
Fix: Add Journeys read to the package and run the audit again. Content Builder pages need Saved Content read in the same way.
Next steps
Related articles
Was this article helpful?