Using Workspaces and Lead Partitions in Marketo

We continue to see more and more questions about Workspaces and Lead Partitions in Marketo and want to provide a framework for helping you decide if the overhead of managing these is worth it. Sometimes it is, sometimes it is not. Workspaces are a special feature that must be enabled and paid for. Even Enterprise instances will require a separate payment or request to activate (usually).

What is a Workspace?

Think of a Workspace as a desk or play area for marketers. Workspaces mostly cordon off assets and Leads from other marketers. The most basic way to think of it is a Master Folder area. Remember how good naming and organization can help keep a Marketo instance clean? A Workspace is the next level up in the Tree. In fact, everyone has a Default Workspace at the top of the list. Most of us have just one Workspace that’s effectively invisible.

Workspaces can “see” Lead Partitions. Again, most of us have one Workspace with one Lead Partition. But some of us need to have some marketers use a separate play space as well as see different kinds of Leads.

Remember that a Workspace is more akin to a “space to do marketing activities,” while a Lead Partition (LP) is a division of your database that requires a deliberate action for a Lead to move across barriers to a different LP. Lead Partitions do not live inside a Workspace, even if that is effectively what happens in many cases. Here are some diagrams to help.

Rules for Workspaces

Please be sure to read the official docs for more details. Workspaces (WS) are as powerful as they can be frustrating when the rules aren’t followed. Here are a few of the key rules to understand.

• Assets can be shared between WS. This is a great way to share Templates, but it has limitations.
• Default WS usually has access to all LPs and this is recommended so you can set up a central system to manage global leads. (There are some cases where you may not want to).
• WS can see more than one LP if desired.
• WS users and assets and campaigns can only see the Leads for the LPs it has access to. (This is critical! A lead will not trigger a campaign in a Workspace that has no access to it).
• Segmentations can be shared, but only 20 can exist in the entire instance.
• Filling out a Form in a WS means the Lead can only be in that WS/LP combination (see rules).

Best Practices with Workspaces

• Center of Excellence: share master Program Templates in a Center of Excellence WS with an empty LP. Give access to all marketers to clone over Programs from this space.
• Design Studio: share master assets in a Shared Template folder in the COE.
• Default WS: ensure that Default has access to all LPs and has a central LP routing system in addition to the Admin Lead Partition Router.

Workspace Features and Functions

Workspace Assets can only act on Leads which they can see

This means if you have a smart campaign, form, smart list, etc., it will only react to Leads in the Lead Partitions accessible to that Workspace. Global triggers should live in the Default or Global Workspace that has access to all Lead Partitions. For example, if you have an EMEA lifecycle system, and a Lead lives in the Americas, the EMEA lifecycle won’t process that Americas Lead, unless the EMEA workspace can see the Americas Lead Partition.

Sharing Assets Across Workspaces

It is best practice to manage Asset sharing with a Center of Excellence WS where you can place Globally used Program Templates, Smart Lists, and other Assets like Email or Page Templates. Other users will come in and clone or reference these. One of the big pain points here is if the Sharing rules aren’t quite perfect (like forgetting to share the folder to all the Workspaces.  For Etumos, our COE WS is labeled “Framework,” as shown above.

People also get caught up when they use a shared Segmentation or Smart List. The rules may be global, but the data returned will only be for the Leads visible to that Workspace. If your Workspace can only see one LP, then it will only return leads from that LP.

Sharing Segmentations Across Workspaces

A neat way to manage data is Segmentations. You can have 20 across the instance, and it is usually ideal to build Segmentations in the Default Workspace, then to share them across all Workspaces. Share Master Segmentations across all WS, however, save at least 10 for local WS use. It is helpful to name Segmentations with the WS name in which they originate, so most will look like:

Default - Language 
Europe - Country

What is a Lead Partition?

A Lead Partition is a section of the Marketo database. A simple, but inaccurate way, is to think of a Lead Partition as one database table, separate from other Lead Partitions. If you have more than one Lead Partition (LP), you effectively have several databases that are mutually exclusive. In reality, the LP isn’t a separate database, but the system treats it almost that way.

Rules for Lead Partitions:

• A lead can exist in only one LP at a time.
• Cannot have email address dupes across the system (Marketo throws an error)
• Can move a Lead between LPs.
• An LP can be seen by more than one Workspace.

When creating the WS/LP for the first time, you should create the Lead Partitions first, then the Workspaces.

Lead Partition Routing System

When you first setup WS and LPs, you should also setup the central Admin Lead routing tool. This works a little bit as a backup, however, please do not rely on it. It works ok if you are routing leads based on Country or a specific field that will be available on the initial Form or creation. Thus, it becomes a two step process to ensure leads get to the right Partitions.

Option 1: leave everyone in the Default LP for routing by a smart campaign.

Option 2: route by the same rules in Admin and Smart Campaign

Either should work, although a smart campaign can be more effective. In a thread with Marketo Champ Dan Stevens, we discuss some of the ways to consider a central routing for Leads as well as caveats with WS Asset and LP access.

List Import and Data Processing Considerations

Leads are deduped in Marketo by email address. A lead can exist in one LP at a time. On a List Import, Marketo will throw an error if it sees that a lead has a dupe in another LP that this Workspace does not have access to. It will NOT attempt to move the Lead or update it. You can see the errors on the little post-import error box by downloading the error list.

Typical Use Cases

When should you consider a Workspace+Lead Partition as a solution to a problem? There are several primary use-cases as well as a few needs that may prompt this conversation.

• You want to prevent campaigns of Type A touching Leads of Type B.
• Put up walls between Teams, Countries, Divisions, or Groups.

We urge you to think through it carefully because Workspaces cost money and cost a lot of time to build out and manage. It absolutely can be worth it when done well.

Multi-Country Regional Division

Let’s say your firm is in 30 countries and divides up work by Americas, EMEA, and Asia. But you have Marketing and Sales Teams divided by Region, not individual countries. In this case, you may just want Region or Country Workspaces depending on the size, rules, or importance of the Country. Ideally, this mapping is Regional Marketing Team: Regional Divisions to keep the system well-governed. The challenge if you wanted to have a single Country, single Team matrix with more than 20 or 30 countries. Marketo can do this, but it becomes unwieldy eventually. If there are that many countries, it may be best to use Regional Marketo instances divided by Country Workspaces.

Multiple, but separately run Business Units or Divisions

Another common option is to use one Marketo instance across the firm, but each Business Unit (BU) gets a separate WS and LP. This setup is usually okay as long as the data systems run well and there’s little cross-sell to worry about.

Multi-Brand Cross Sell: Most of the Nation threads on Workspaces is when people divide up BUs with Workspaces, and then want to cross-sell but retain a single Lead record and have the different brands communicate to that person. In this situation, you may want to use a single LP with multiple Workspaces. You may also just want to keep one WS+LP and not trouble yourself with the extra work. As long as you can identify records effectively and work with counterparts at other brands, cross-sell can be managed without overwhelming the Lead.

Restrict Access to Data: Country

With all the different privacy rules around the world, some firms may need to restrict data access to marketers only in that Country. Of course, the data itself may reside in the US, EU, or another data center, so Lead Partitions do not resolve the physical location question, only the access levels. If your legal team truly needs physical location separation, you should discuss this with your Marketo Account Manager and SalesOps. You could buy separate instances instead, but there are likely issues with that, too.

Restrict Access to Data: Prospects vs. Customers vs. Partners vs. Employees

It is possible to compartmentalize data by Record Type (Lifecycle Type) and Marketer Role. You could even add Employee information as part of your Internal Comms strategy (although we don’t recommend it).

When separating out records by Lifecycle Stage or Type, it helps to be able to clearly identify the record. You can use fields or Account fields to help identify Prospects vs. Customers. Firms that also have Partners or Channels should setup clear rules not just with Account Type=Partner, but Record Type ID (in SFDC) as well as properly managed child relationships. That way, as soon as a person is identified as belonging to a Partner, they can be shifted to the correct Lead Partition and away from those aggressive acquisition marketers. 😉

Some firms also want to keep marketers in each group out of each other’s hair as much as they want to separate those communication types. A solid WS+LP setup is one way to prevent toe stepping or missends. We’ve all had those moments where that smart list filter didn’t save as NOT IN “Customer List” and we send a 20% discount to every client (oops). With a WS for Customers, it becomes nearly impossible for Demand Gen to send an email to a Customer because they simply don’t have access. It’s only as foolproof as your data governance, of course.

To properly compartmentalize access and data, you would then provide only Acquisition Marketers in Japan with access to the JP-Prospects Workspace. Their activities would not be able to access Customers or non-Japan data. This is easily done in Admin > Users. As you can see, the major pitfall here is we have 15 Workspaces and we’ve only covered a few company locations. What happens when we add APAC or Middle East & Africa?

A variation on this use-case is to divide records by Record Type or Persona. For example, a healthcare firm might use separate WS/LPs for Patients, Doctors, and Distributors. Think through your scenarios very carefully before implementing because it is very hard to course correct once data is flowing.

RCM and Multi-Workspace Systems

Depending on your Use Case, you may have one or more Revenue Cycle Models per Workspace. When you have multiple RCMs, you have multiple campaigns running and managing the Lead Lifecycle. This can add overhead to your instance’s ability to process data. It’s not always a big deal, but the only way to watch this is from the Default WS that can see all of the campaigns running. You may also need to spend more time turning off old things to keep the instance humming.

Fortunately, the WS can only see the Leads in the LPs you have access to, so it becomes very much a separate Lifecycle, which you can tailor to each Country or Use case. In RCE, you will be able to divide the data by WS or Partition, or just by the individual Model very easily. There are a few tips:

• Lead Lifecycle/RCM – do your best to use the same or similar setup for each WS. It’s ok to have different MQL thresholds, but the process your marketers follow should be similar enough to compare Regional performance.
• Add Fields: add a Lead Partition and Model Name field to your database and sync it to SFDC. This can help track back issues later as well as divide up data more easily.
• Add WS Tag to your Programs – will help you divide data later in RCE.

Caveats and Pitfalls

Dealing with the Cross Partition Dupes and possible solution with a Custom Duplicate Rule. As a rule, it is difficult to deal with Dupes in this situation. If you are going to use WS/LPs, then be fairly certain the Leads won’t come in from multiple forms in different Workspaces. You can get around this with Purposeful Dupes and the Custom Rule.

Workspaces and LPs do not allow multiple SFDC Instances. Marketo is a 1-1 relationship with SFDC. You can use SFDC’s Partition rules such that the Workspace in Marketo aligns to the Partition in SFDC. A good example is Workspaces by Region or Country where SFDC doesn’t allow individual users to see or work with other Regions’ records. Marketo itself isn’t really impacted as long as the Marketo User can still see everything. Only your LP rules will route the leads to the matching Partitions in Marketo.

Subscription Centers – usually you should do this Globally because if someone unsubscribes, they unsubscribe across the entire instance. Dan Stevens wrote a little about this. You can put the Subscription Center in the Default WS, which uses Dynamic Content to display the Form in several languages based on the Language Segmentation. It’s critical that this Form lives in the Default-Global Workspace that can see all data. If not, it will be unable to properly update records. Even if you decide to keep a Subscription Center locally, you should still offer a Global version on your Global website or as a backup.

Problems with Cloning and Sharing Assets: whether you use the COE or not, this can be a frustrating area to handle because if an Asset tries to reference an Asset it can’t see in another Workspace, you’ll get an error. Make sure your folder sharing rules are correct and be ready to just paste a Template back in somewhere.

User Access: Once Workspaces are live, you must go into Admin > Users to adjust each person’s access. Most users should have access to a single Workspace. Some may have several Workspaces or even different access levels to different Workspaces. Only Admins or Local Admins should be granted high-level or multiple Workspace access. You may even want Read Only access.

Adding WS naming to your organization – makes a big difference. I always recommend adding a Workspace code to all Programs and Assets. This will be useful when using RCE that sees all Workspaces as well as ensuring naming references are consistent to avoid confusion. Marketo still requires every asset to have a unique name across the Instance.

WS-REGION-TYPE-DATE-NAME

Too many WS and LPs.  As a global admin, it may become difficult to manage by yourself. Have strong local admins who understand how to manage their WS without you.

Removing Workspaces and Partitions – during setup, really plan this out. To remove a WS/LP is a big pain because you have to remove all of the Leads from the Partition as well as all of the Assets. It takes a lot of time. If your instance is old, it may be worth just deprecating that WS/LP by changing its name.

A lot of people ask about WS/LPs too early in their understanding of Marketo or their firm’s journey into marketing automation. The feature solves a particular, large-scale problem and is not for everyone. Here are some examples of when not to use it:

• Less than 1MM records.
• Small marketing team or a few international marketers. Foldering should be enough.
• The data concerns can be solved with Folders or New Fields to clearly demarcate records. For example, people often ask about multi-brand instances. Many situations can be resolved with Product Interest field or Brand Owner field along with some rules of engagement for communications.

Resources

• Global Rollout slides 
• Thinking through Workspaces
• New Lead, Different Partition
• Smart Lists and Workspaces
• Official Docs

Free Health Audit

If you have workspaces and partitions and would like one of our experts to review your setup, we can deliver a free health audit.

We all like gifts. Whether it’s from a family or a vendor, gifts are appreciated.

Vendors of all types send each other gifts from time to time. Sometimes it’s a small annual token for doing business together, sometimes it’s an outright gift for just listening to a pitch (ahem, martech vendors). Or an incentive for filing out a survey. Whatever the reason, you may be wondering how to automate giftcard sends.

Why send gift cards to clients and prospects?

• Survey Incentives for completing surveys
• Thanking advocates
• Holiday gifts for Customers
• Thank you for patience or apologies.

I’m not going to comment on the ethics or efficacy of this type of gift. This article is just about automating the gifting process.

Gift card sending is tedious because you must go through a lot of process because it’s a cash payment and small, untraceable physical items tend to disappear. I managed this process once for a survey incentive and spent more time ensuring the cards didn’t go missing than anything else. If you do this regularly, you might:

1. Go to Finance to get approval.
2. buy the cards.
3. log all the cards.
4. Pull together the list of recipients, addresses, etc.
5. Confirm the recipients should receive a card.
6. Match the card number to the recipient.
7. Do a mail merge (yours or a vendor).
8. Figure out if the recipient will have to reject it.
9. Collect and log returned items.
10. And you’re really sure if the person received it.

Why go through all this when you can automate the whole process while maintaining the right records?

If you’ve received a small gift card from a vendor recently, it might have been through a service called Rybbon, founded by Jignesh Shah. I had a chance to speak with Jignesh, go through a demo, and test out the service. (I did not receive any gifts from Rybbon). I did enjoy the setup and gift process because it’s surprisingly simple. I barely read the directions to get a campaign working; and when I can successfully send a $5 giftcard in a test with minimal help, I know it’s simple.

What is Rybbon?

It’s a point service that allows anyone to send gift cards electronically and in a traceable way to one or more recipients. The service is only for gift cards and does not currently offer fulfillment of other items. Rybbon offers a wide selection of US and international e-gift cards.

How is Rybbon Priced?

Rybbon’s pricing levels are interesting. After the free version, there are more features and a 10% processing fee per card. Rybbon also refunds all unclaimed gifts, which is a big plus since unused physical gift cards create issues for compliance. You can try the service out for free, up to 100 cards in the US only.

Setup in Rybbon

Once you have an account, adjust the settings to personalize Rybbon for your brand.

 

How it Works from a CSV file in Rybbon (Direct Method)

There are two ways to use your Rybbon account. The first is what I call the “Direct Method” which is to use Rybbon as a standalone service. Just create a Rybbon Campaign and upload leads. The second way is to integrate Rybbon with Marketo or another tool.

Step 1: Choose a gift card and options

Step 2: Upload Names

Notice that whether you add an email by hand or import a CSV, deduping happens automatically. This was nice, because I didn’t realize the system had accepted the first name, so I typed it in again.

Step 3: Customize the Email

Note that you can go into Settings and adjust the From Email and Domains used so the branding is consistent and Spam filters will view this as a legitimate email. I did not do that here because it’s a demo account.

You can also further customize the email by clicking the Edit icon in the middle right.

Step 4: Customize the Page

Step 5: Pay

This was a test account. Note that you can Save in the upper right corner if you aren’t ready to deploy this campaign. You do receive a receipt immediately, however, unsent cards can be refunded immediately. Unclaimed cards are automatically refunded after your chosen claim period ends. This is helpful because you never quite know how many people will claim, or be able to claim, your cards.

Step 6: Watch the reports

One way to use this page is to collect data on an AB test of gift cards. Do Amazon cards work better than Best Buy? Depends.

Remember, you only pay for cards claimed by the recipients.

How it Works from Marketo

In Marketo, you can use Rybbon through an Email Script Token (Velocity Script) that you get from your Rybbon campaign and then insert into your Email. If you’re afraid of Velocity Scripts, don’t be. I don’t know the script language at all, so I copied the code, pressed a couple of buttons and it worked. This can be a great gateway to learning Velocity Scripting. The nice thing is you can use this Script in a Batch or Trigger flow!

Now, there is a feature in Rybbon where you can receive back info if the Lead accepted your gift. This requires the REST API and integration. It’s not hard if you’re an Admin. I did not test this feature. I’ve used a similar feature from PFL and it works well to trigger flows based on Delivered.

So how do you get that Script in there?

While Velocity Scripting brings up the imagery of “hard,” it turns out it isn’t. The script template I received from the Rybbon campaign setup renders the image and a link back to the Rybbon claim site. It doesn’t even need an API connection.

Step 1: Create a Marketo Campaign in Rybbon

To get here is similar to the Step 1 in the Direct method, just choose Marketo.

Step 2: Get the Marketo Token for the Campaign

You can get the token during the Setup process too.

Step 3: Copy Script

Step 4: go to Marketo Program

Step 5: Create Marketo Email Script Token

Step 6: Paste in Script and select the 4 fields: Company Name, Email Address, First Name, Last Name

Step 7: Add Email Script token to your email.

Step 8: Test the Email with a Lead sample.

You must follow this carefully if you want to deploy a Test. Failure to connect the Sample to a test Lead will cause it to fail.

Step 9: Approve and Go Live (Batch or Trigger)

What if I want to have Sales trigger a gift card send?

The script won’t work if you expose the email to Sales Insight. The better way is to create a Trigger flow with the Campaign is Requested from Sales Insight feature. Then train your reps to use the Add to Marketo Campaign feature in SFDC. Other integrations include SurveyMonkey.

If you’re concerned about Sales using up a limited budget, there are a few ways to control this:

• Setup a Program with Requested or Wait List Program Status.
  • Review and Change Status to Approved – Send (with a trigger/batch to Send).
• Just let the cards run out and shut off the Campaign when the budget is at $0.

Conclusions

Rybbon is an easy to use, solid solution to gift card sending and processing. Whether you use it standalone or with Marketo, Rybbon makes gift carding fast. In terms of ease of use, it’s simple. There’s no real need even for the API connection with Marketo if it’s not that important to you for logging acceptance. I picked up the key parts within a few minutes. There are a few other gift card tools out there, some are limited to sending coffee, or require more complex setup. Rybbon seems to have struck the right balance of simple, scalable, and powerful for marketers.

Interested in learning more about Marketo? Subscribe for big news in April.

Most of us using Marketo for demographic scoring are using a basic trigger or batch campaign that only listens once when the Lead is Created or the Data Value is Changed. This means that the first time the Lead shares with us her Title or Department, we score it.

That’s it.

We never re-score that Lead no matter what else changes in her demographic profile.

Should anything change in that profile, we do nothing. Now, you might think that it is rare for a demographic profile to change, and that it is more likely the Lead leaves their original firm before their Title changes. Probably true!

But what if we are wrong about that? What if the profile looks more like this the first time the Lead tells us about themselves?

NAME: JD

EMAIL: XXXX@gmail.com

TITLE: whatever

COMPANY: MRG

PHONE: 617000000

(How many times have you done this yourself, let alone see it in your system?)

We would likely score this Lead low on Demographics and fairly high on Behavior. The next time the Lead fills out a form, they update the email and Title because now they are more serious about speaking with us. Yet, the system never updates their Demo Score! Thus, it can potentially hold back leads that should have been MQL, or prioritized by Sales.

To resolve this gap in our ability to rank leads, let’s introduce Demographic Rescoring. This is a technique I learned from Marketo Consultants, but I’ve rarely seen anyone else implement it, including other Marketo Consultants!

Step 1: Main Trigger

Create a central trigger that listens for any new lead and only the Data Value Changes you want to score on. If you are concerned about lead volume creating a trigger backlog, then you might want to daisy chain this into your lead lifecycle, or use a batch system instead.

This central flow will then re-set the Demographic scores.

Step 2: Request Campaigns for Each Demographic Field

Once the Demographic Score is re-set, the flows will call the scoring flows that are needed. So if the lead only qualifies for a Title score, that’s all it will get.

Step 3: Test

Before trashing the old system, test the new system by adding the Email Address CONTAINS brake and run some new leads and old test leads through it.

What you should see is that changing the Title triggers the main flow, which requests all of the demographic score campaigns and it attempts to re-set and re-score each value we care about.

Then look at the Lead’s Log Activity. Most of the time you should see a complete score re-set for Demographic Score and a re-build.

Then look at the Campaign’s Results tab. Most of the time you should see complete log of the re-score and rebuild. I’ve noticed that sometimes the Results seem to skip over the re-score, yet the score is fine in the end. Just be aware of this.

Step 4: Activate

There is no need to re-set everyone’s scores ahead of time, unless you really want to do so. Keep in mind that if you want to re-score everyone’s Demo Score, you can do so with a Batch campaign instead (which will be faster and safer). All we are doing here is converting the old system to a new, responsive one that will only trigger on New Leads and Leads who change their information.

Caveats

There are a few caveats to consider:

• Re-scoring seems to fail, or appears to fail, from time to time. At least that’s what the logs say. An actual failure may be rare.
• High Volume Systems create a giant trigger backlog because this relies on triggers.
• Batch System may work better – you could run a daily batch to call the child triggers on Request Campaign. You can also run a daily batch overall instead. This depends on how badly you want to re-score demographics.
• Data appending will trigger this system frequently. Again, it could cause a backlog if this is high volume.

Long time readers know I’m not a big fan of demographic scoring at all, but many firms do this and this is how to handle re-scoring.

The other day, I was at a fun Marketo User Group where we discussed what not to do in Marketo. Outside of the April Fool’s Day post, what else should you consider not doing in Marketo and other marketing automation platforms?

Allow Everyone to Delete

This level of access is easy to overlook depending on the system. In Marketo, the Delete Lead right is under Lead Database even though you can do this from a variety of screens. It’s also easy to overlook because the default settings allow nearly everyone to do this. And who would delete a lead without a good reason?

Turns out, it is very easy to delete leads improperly! Here’s quick story to illustrate why you should immediately remove Delete Lead from every user other than Administrators:

A person uploads a list to your database and realizes the list is in the wrong Program. The leads are now Members of that Program as well as that List. The person does Select All>Delete Lead in SFDC as a Single Flow Action.

Experienced Marketo Users, in fact, all Certified Users should know that Membership of Programs and Lists has nothing to do with the Lead itself. The correct action is to clone the List to the correct Program, or take the email addresses and re-upload that column to the correct Program. Then you can run a Program Status>Not in Program to remove the incorrect placement. Only then can you delete the original Static List. There is no reason to delete leads in this situation.

The permission to delete Leads can also pose a larger security risk if you forget to remove access for disgruntled contractors or staff.

Allow Download Leads for Everyone

While less risky in some situations than deletion, there are still plenty of people willing to run an export on your database and walk away with the leads. You may never know this occurred. The critical risks are people walking away with your email list to sell it to the highest bidder. If you also put more sensitive information in the MAP such as credit cards or identity numbers, then you just put your clients at risk of identity theft. The liability here can be tremendous, even with airtight contracts and insurance. Best to lock down your Roles such that only trusted staff can export data to encrypted drives.

Now that Marketo has the Audit Tool, you should use it occasionally to see if anything is amiss.

Forget to Sweep the User List Regularly

I personally do this about once a month. It’s unlikely IT or HR will ever remind you that so-and-so left the company. And don’t rely on word of mouth for this either. Not everyone who leaves does so with a goodbye note.

The other day I decided to walk through the entire user list. I removed seven people and set time limits on several more as I realized just how many people should no longer have access.

Tricks to doing this quickly:

• Sort by Last Login Date (see below)
• Look for Users who never logged into the original invitation (First Login Date)
• Sort by Name
• Always note contractors by firm Name in Last Name or Reason

Give Out Admin Access Like Candy

Not that you should give out candy to anyone…but I’ve seen a lot of situations where SFDC Admins and Marketo Admins were in abundance for no particular reason. One firm had nearly everyone, including Salespeople, as Administrators in SFDC. Another Marketo instance had 10 admins, including contractors that weren’t doing much anymore. If you are an Administrator, you should ask people to justify the access requirement while training them and watching to see if they are trustworthy. Always begin with the lowest possible access level and make people call you with the need for more access. This is not just about untrained users, it’s about compartmentalizing the risk if a hacker obtained access through a user.

Remove API Users

The big caveat to user sweeps is API Users. Good Admins will name the user “Website API User”. However, the API users never trigger a Last Login Date, so it’s easy to see that and remove the User before figuring it out.

Not Customize Roles

I suspect in most MAPs there is a similar tool to Marketo’s Role tab. The default Roles are not well differentiated from each other. The defaults also are very permissive other than Analytics and Web Designer. Essentially, everyone can do nearly everything. While I’ve written suggestions in the Guide, here are some thoughts:

Role Name	No Access to
Analytics Only	Lead Database Design Studio Marketing Activities No scheduling No approval rights or deletion rights or run single flow action
List Uploader Only	Marketing Activities (or limited) Design Studio Delete Lead No scheduling
Marketer – New User (no approvals)	Design Studio No approval rights or deletion rights No scheduling
Marketer – Limited	Design Studio changes No approval rights or deletion rights No scheduling
Marketer – Medium	No Deletion Rights Approvals may be limited
Marketer – Approval	No deletion rights, no single flow action No edit in Design Studio
Super User	No deletion rights, no single flow action
Web Designer – No Approval	No approvals No scheduling Lead Database Analytics
Web Designer – Approvals	Lead Database No scheduling Analytics

Use or Allow the Run Single Flow Action

When I first started to use Marketo, I did this occasionally on small groups of leads because it is easier than building a whole smart campaign to do the same thing. As I learned more, however, I saw that using this feature meant that reversing the Change or finding these leads again became nearly impossible – once the data changes, the smart list might no longer display these leads.

For example, if you Run a Single Flow action with Change Data Value (or Delete Lead), the system just runs it immediately. Since there is no Smart Campaign, there is no reference point such as Member of Smart Campaign to find these leads again if you need to do so. There’s no audit trail good enough to find this group easily, or at all.

In other words, it is a dangerous tool even in the hands of an experienced user. Restrict it to Admins and even Admins should never use it.

Automate Deletion of Junk Leads

This automation is tempting. You pre-suppose you know exactly which leads are Junk somehow. How sure are you of your database matching skills? What if something else goes awry and triggers deletion on real leads? For example, I once modified a Lifecycle Stage incorrectly, pushing 4,000 records into a Delete Wait Step…fortunately I had a few days to uncover the error. Deletion is much better as a careful process that includes backup steps outside of the MAP.

Do you have other “What not to do tips” for the rest of us? Put them in the comments below!