Stop HubSpot or Marketo overwriting your first touch
A contact property holds one value, so a hidden utm_source field is rewritten every time that person submits another form. The fix is two sets of properties and an automation that copies one into the other only while the target is empty. If you would rather run this as part of the whole setup, use Source tracking setup — it builds the same automation as its third step.
Before you start
Create the 17 tracking properties in your tool and put the Most Recent set on your forms. This article builds the piece that runs after them.
Permissions required
HubSpot needs the automation scope on your private app. Add it at app.hubspot.com/l/private-apps — open your MarqIQ app, tick automation under Scopes, save, then reconnect HubSpot in MarqIQ. Without it the creation answers with a 403 and names the scope.
Permissions required
Marketo needs Read-Write Assets on the role behind your LaunchPoint service, and Read-Write Lead as well if you want Run workflow · N records. Marketo has no link to open, because its admin screens sit on your own instance's sign-in host: go to Admin, Security, Users & Roles, Roles to edit the role, and Admin, Integration, LaunchPoint to see which service uses it.
Build it in HubSpot
Open Tool Operations in the sidebar, pick your tool, and open First-touch Backfill.
The page itself is headed Source Tracking Workflow. It is the same page.
Choose HubSpot.
Click Create HubSpot Workflow.
MarqIQ creates a contact workflow in your portal named "[MarqIQ] Source Tracking — Copy Most Recent to First Touch", with eight Edit record actions, one per field pair. If a workflow with that name already exists, MarqIQ returns it rather than creating a duplicate.
Click Open in HubSpot.
Read the enrolment criteria and the eight actions.
Enrolment is "UTM Medium (First Touch) is unknown AND UTM Medium (Most Recent) is known". Re-enrolment is off. Each action writes the most-recent value into its first-touch counterpart.
Switch the workflow on in HubSpot.
MarqIQ creates it turned off. It does nothing at all until you enable it, which is deliberate — you are the one who decides when contacts start being written to.
Fill in the records you already have
A workflow acts on enrolment, so it never reaches the contacts created before you switched it on. Run workflow · N records on the same page writes the same rule straight through the CRM API, which a new workflow cannot do.
Click Sync now for accuracy above the button.
The count is read from the copy MarqIQ took at the last sync. One press runs the sync to the end, however many stretches that takes, and shows how far it has got; it stops at the first error and says what it was. A sync first means the count is the one your tool would give now. Whether a first-touch field is empty is not decided from that copy: the run reads each record from your tool again just before it writes.
Read the count and the rule beside it.
The page shows how many of your synced records match, out of how many were synced, and how long ago that sync ran. Where your tool refused records in the last 7 days, it says how many a run leaves out and until when.
Click Run workflow · N records.
MarqIQ asks you to confirm first, and says how many records this run takes. One run takes at most 2,000. It reads those records from your tool, 100 at a time in HubSpot and 300 in Marketo, and writes only the First Touch fields your tool holds empty at that moment.
Read the result above the count.
The first sentence says how many records were written, and how many more may have been. Each other count has a line underneath, named for what happened to its records. The last line says what to do next.
| The result says | What it means | What to do |
|---|---|---|
| refused by HubSpot | HubSpot answered for the record and did not write it. Nothing was written to it. Its reason is listed. Where there is more than one reason, each says how many records it was given for. The five most common reasons are shown, and the result says how many more there were | Fix what the reason names before you run the workflow again. A refused record stays in the count; the next 7 days’ runs leave it out, so it no longer holds the others back |
| refused by HubSpot in a batch | HubSpot refused a batch of up to 100 records that held this one, or wrote the rest of the batch and left this one out. Nothing was written to it. The run sends each such record again on its own to find the one at fault, and its time was up first. What HubSpot said is listed. It is about the batch, so it may be about another record in it | Fix what HubSpot said, then click Run workflow · N records again |
| refused by Marketo | Marketo answered for the record and did not write it, or refused the whole request (its sign-in, its permission, its limit of 100 calls in 20 seconds or its daily quota, a field it does not have). Nothing was written to it. Its reason is listed, with how many records it was given for, as for HubSpot. When Marketo says to slow down, the run waits and sends again before it counts a refusal; when its daily quota is used up, the run stops sending and the reason says when the quota resets | Fix what the reason names before you run the workflow again. A refused record stays in the count; the next 7 days’ runs leave it out, so it no longer holds the others back |
| not answered | The record was sent and your tool did not say whether it wrote it: nothing came back, or an error of the tool’s own (for Marketo a system error, a time-out or a 5xx). It may have been written | Click Sync now for accuracy. A record that was written leaves the count. Run the workflow again once that sync has finished |
| not reached | A run stops reading and writing after 54 seconds, into HubSpot or Marketo. This record had not been read or sent by then, and nothing was written to it | Read the last line of the result. It says to run the workflow again, and what to do first where the tool gave a reason or left records unanswered |
| filled in HubSpot since the last sync | When the run read the record, its first-touch medium already held a value in your tool, so the rule no longer applies. Nothing was written to it, and MarqIQ’s copy takes the value your tool holds, so the record leaves the count | Nothing. Somebody or something filled the first touch after the last sync, and the run left it alone |
| not in HubSpot any more | The run asked your tool for the record and it was not there. Nothing was sent for it | Nothing. The next sync takes it off the count |
| not read | The run could not read the current values of these records from your tool (its sign-in, its permission, no answer, or the time was up during the read), so nothing was sent for them. What stopped the read is listed | Fix what the line names, then click Run workflow · N records again. The next run reads them again |
| refused last time, skipped until a date | Your tool refused these records for a reason of their own in the last 7 days. The run leaves them out so they do not use up its time, and tries them again after that date, or sooner if a sync changes the values they would be sent. A refusal of the connection’s own (the sign-in, the permission, a limit, a missing field) is never held against a record | Fix what their reason named. Once the values change in a sync, or the date passes, the next run takes them again |
The first sentence and the counts under it add up to the records the run took. The line about records refused last time and the one about records left for another run stand outside that sum. A count that is zero has no line.
The run reads before it writes
Whether a first-touch field is empty is decided on a live read of each record just before the write, as an approved change set decides it — not on the copy MarqIQ took at the last sync. A first-touch medium filled in HubSpot or Marketo since that sync takes the record out of the rule; any other First Touch field filled since is left as it is and only the empty ones are written. Until 22 October 2026 the run judged emptiness on the synced copy, and a value filled in the tool since that sync was overwritten.
The two field sets, and what guards first touch
| Set | Fields | Behaviour |
|---|---|---|
| Most Recent (Last Touch) | 9 | Written by the tracking script on every submission. Allowed to change. |
| First Touch | 8 | Written once, while empty. Never overwritten. |
The two sets MarqIQ creates. The ninth Most Recent field is UTM Campaign ID, which has no first-touch counterpart.
The enrolment condition is what protects the value. The automation enrols a contact only when the first-touch medium is unknown and the most-recent medium is known, and it never re-enrols. Both halves are needed: without the first, the automation runs again on every visit and overwrites first touch.
Your tool's own original-source field does not replace these
HubSpot's Original Source records a channel bucket such as Paid Social or Organic Search, with two drill-down levels. It is useful, and it is not your campaign, content and term as separate reportable fields. For any contact created by an import or an integration it reads Offline Sources, which in a sales-led company is a large share of the database.
Build it in Marketo instead
Marketo's public REST API can create a campaign but cannot author Smart List rules or flow steps. Adobe's Marketo MCP can, and it is a closed beta allowlisted per Munchkin ID. MarqIQ therefore does as much as your instance allows and hands you the rest.
Open Tool Operations in the sidebar, pick your tool, and open First-touch Backfill.
Choose Marketo.
Read the connectivity line for Adobe's Marketo MCP.
It says either that the MCP is connected, with the number of tools it exposes, or that it is not available and the campaign will be created as a shell. Re-check runs the test again. Adobe documents the beta and how to ask for access at experienceleague.adobe.com/en/docs/marketo-developer/marketo/mcp-server
Click Create Smart Campaign.
MarqIQ creates it in Marketing Activities with the full configuration recipe written into its description, and leaves it inactive for your review. It is placed in a folder named "MarqIQ", because Marketo refuses a campaign created at the workspace root. When the MCP is available, every call and its response is printed under MCP authoring detail, so a failure is diagnosable.
Open the campaign in Marketo.
Read the eight field pairs in the campaign's description.
Each line gives the target field and the token to copy from, written with your tool's API names. Copy them from there rather than typing them, because a field you mapped on Field mapping uses your own API name instead of MarqIQ's.
Set the Smart List trigger.
Trigger Data Value Changes on UTM Medium Most Recent, with the constraint that UTM Medium (First Touch) is empty.
Add eight Change Data Value flow steps.
One per first-touch attribute, each taking its Most Recent token — for example {{lead.utm_medium_most_recent}} — with the choice set to write only when the target is empty. The token is the API name, not the label, so {{lead.UTM Medium Most Recent}} resolves to nothing and Marketo reports no error.
Set the schedule to qualify once.
Tick Executable in setup if you want to call the campaign from other campaigns.
Click Activate.
Take care
Without the "only while empty" choice on each Change Data Value step, the campaign overwrites first touch every time the most-recent medium changes. That is the fault you are trying to remove.
Capture the first visit in the browser too
An automation can only copy a value that reached the form. If the first visit carried UTM parameters and the form fill happens four pages and two days later, those parameters are long gone from the URL. The tracking script holds the first visit in a first-party cookie and reads it back at submit time, which is what gives the automation something to copy.
Safari caps cookies written by JavaScript at seven days. For a buying cycle measured in months that matters, so MarqIQ also keeps the durable record on its own server: once a first touch is known for a visitor or an email address, the earliest known value wins over whatever a fresh cookie jar claims.
If it did not work
Creation fails with a 403
Why: The HubSpot private-app token does not carry the automation scope.
Fix: Open app.hubspot.com/l/private-apps, add the automation scope to your MarqIQ app, reconnect HubSpot in MarqIQ, then click Create HubSpot Workflow again.
MarqIQ says the workflow already exists and you want the newer definition
Why: MarqIQ returns the existing workflow by name rather than making a second one that would fight the first.
Fix: Click Recreate with corrected filters. MarqIQ deletes the old workflow and creates a fresh one, again turned off.
The workflow is on, but contacts created last month still have no first touch
Why: A workflow acts on enrolment. It does not reach back over records that already exist.
Fix: Click Sync now for accuracy, then Run workflow · N records on the same page. It reads each record from your tool first, fills only the first-touch fields that are empty there, and writes at most 2,000 records per run.
You ran it and the count did not reach zero
Why: One run takes at most 2,000 records, and a run stops reading and writing after 54 seconds, into HubSpot or Marketo. The rest are left, not queued. A record your tool refused also stays in the count until its cause is fixed, and a record whose current values could not be read is left for the next run.
Fix: Read the result. Where records were refused, on their own or in a batch, or could not be read, fix what your tool said first. Then click Run workflow · N records again for the records not read, not reached and the ones left for another run.
You run it again and it writes fewer records each time, or none
Why: A record your tool refused for a reason of its own is left out of the next 7 days’ runs, so it no longer uses up their time; the result says how many are skipped and until when. Until 22 October 2026 a later run took such a record again, sent it with the same value, got the same answer, and in HubSpot spent its 54 seconds taking the refused batch apart. What can still shrink a run: HubSpot slow to answer, so the time is up before a refused batch is taken apart (those records count as refused by HubSpot in a batch and are not remembered), or a refusal of the connection’s own, which is never held against a record.
Fix: Fix what the result lists under HubSpot’s reason or What HubSpot said, then click Run workflow · N records again. A record whose values change in a sync is tried again at once; the others after the date the result gives.
The result says some records were not answered
Why: Your tool gave no answer for them, or answered with an error of its own. MarqIQ cannot tell whether they were written, so it counts them apart from the records written and the records refused.
Fix: Click Sync now for accuracy. A record that was written leaves the count. Run the workflow again for any that are still counted.
First touch is being changed again after the workflow ran
Why: Something else writes to the field — an import, a different workflow, or an integration.
Fix: Open Field discipline on the Analysis screen. It names the field, lists the records that changed, and says what made each change.
Most Recent is also empty, so there is nothing to copy
Why: The enrolment needs a known most-recent medium. If the forms do not carry the hidden fields, or the script is not filling them, neither set gets a value.
Fix: Work through the article on new records arriving with no source first, at /help/put-the-source-in-your-crm/new-records-have-no-source. Build the automation last.
In Marketo the campaign was created but does nothing
Why: The campaign shell has no Smart List trigger and no flow steps until either the MCP authors them or you do. It is also left inactive on purpose.
Fix: Follow the recipe in the campaign's own description, then activate it.
In Marketo the flow steps run and copy nothing
Why: The token in a Change Data Value step is the field label rather than its API name.
Fix: Replace each token with the API name from the campaign's description — {{lead.utm_medium_most_recent}} rather than {{lead.UTM Medium Most Recent}}.
Next steps
Related articles
Was this article helpful?