Pardot users were greeted this morning with a new announcement banner on their home screen when logged into Pardot:
This banner linked them to a help & training article outlining the details of Pardot-Only Login Retirement. The knee jerk reaction for some was fear — does this mean license costs are going up? What do I need to update right now?
Let’s break this down and talk about what these changes really mean.
How login access is changing with this release
There are some small but important things that are changing with regard to user access in the Summer ’20 release.
The first is that Pardot API access is now available with Salesforce login credentials. The Pardot API can still be accessed with Pardot-only user credentials. Since Salesforce user authentication contains additional security, however, martech vendors with a Pardot integration would be wise to start making updates now.
Second, Salesforce User Sync will also be getting some upgrades to allow for more granular control over who sees what.
And lastly, if you’re a Business Unit customer, you’ll also get access to a little in-app drop down (referred to as the “switcher”) that allows you to flip back and forth between BUs (vs. having to maintain separate logins.) I’m really excited about all of these changes — they’re definite wins for usability.
How login access is changing in future releases
There are some additional changes coming in the Spring ’21 release that will impact many Pardot customers — and these are the more controversial ones.
The biggest change highlighted in Knowledge Article is that Pardot’s legacy login system will be discontinued and Pardot will need to be accessed with Salesforce login credentials.
The driving force behind this update is security. Leveraging Salesforce logins allows admins to leverage a much more robust set of security features to control user access, including org-specific password policies, setting login hours, requiring two-factor authentication, and more.
The difference between SSO & Pardot-only users
Today in Pardot we can have two types of users: Salesforce SSO Users, and Pardot-only users. Pardot-only users are free of charge, and are frequently used to grant Pardot access to:
- Marketing team members who don’t need to interact with Salesforce data
- API integrations
- External marketing agencies who aren’t cleared to access Salesforce
In the past, having the ability to spin up free Pardot only users for these 3 use cases was a much needed functionality. But I’d argue it’s less important than it has been historically.
Let’s start with #1, marketers not using Salesforce. The number of marketing automation pros that don’t have to interact with Salesforce data is rapidly dwindling. Marketing and sales team alignment is one of the biggest reasons customers choose Pardot over the competition — and that starts with working in the same system.
Most, if not all, of the exciting features released in the last year plus have been new functionality for Pardot built in Sales Cloud. Sales Cloud access is needed for Connected Campaigns, Campaign Influence reporting, Pardot Business Units, B2B Marketing Analytics, and the new Lightning Email Builder, among other features.
As for #2, API integrations — authenticating access through a Pardot-only user has been a function of necessity up until now. It was the only option for developers. This is being addressed in the Summer ’20 release and will be a non-issue by Spring.
As for #3, external marketing agencies — with the amount of data now accessible through Pardot (prospects, customers, opportunities, custom objects), do you REALLY want anything less than the most secure login authentication possible for users outside your company?
What will happen for customers who rely on Pardot-only logins?
Because of the reasons listed above, I think there’s a strong case to be made for migrating all Pardot users to Salesforce SSO users ASAP. Still, there may be some customers that want Pardot-only access — if only just because they’re used to it working that way.
Pardot’s not going to leave those customers high and dry, although they haven’t yet released the full details on what the transition options will be. Here’s what they said in the main Knowledge article about the change:
To support customers with Pardot-only users who do not need a full Salesforce license, Pardot will be bundling Salesforce Identity licenses with all Pardot editions. The exact number of bundled licenses is still being finalized, but it will cover the needs of nearly all Pardot customers. These licenses will be backfilled into all existing customer orgs later this year.
In short: Salesforce will give you some courtesy / “freebie” licenses that allow you to use Salesforce SSO but only access Pardot. More details on this were shared in the Pardot User Migration Knowledge Article as well.
If you have zero Sales Cloud logins (i.e. you’re a very old legacy, non-Salesforce customer), the Salesforce team will be reaching out about a transition plan.
Does this change mean salesforce is changing its pricing model?
No, not really. As I mentioned, there are still some yet-to-be-released details on how the identity licenses will work… but Pardot pretty clearly states in its help documentation that charging people more money is not the driving motivator.
To quote them directly:
Will this change increase the cost of using Pardot?
No. While Sales Cloud and Service Cloud licenses do have a per-user cost, Pardot will not require that all users have one of theses licenses to continue using Pardot. As part of this change, Salesforce Identity licenses will be bundled into your Salesforce org at no additional cost and can be assigned to users who do not need a full Sales or Service Cloud license.
And stated again, for the record:
Is Pardot moving to a seat-based pricing model?
No. Pardot’s pricing will continue to be based on contact database size, which is industry standard for marketing automation. While Pardot does offer additional functionality to Salesforce users with a full Sales or Service Cloud license, Pardot is not going to start requiring one of these licenses.
What do I need to do now?
As I mentioned, the most significant parts of this change don’t hit Pardot accounts until Spring ’21. So there’s time. But here’s what I’d recommend doing to stay ahead of the game:
- Audit your current users. How many are Pardot only? Are there any that can be archived? Enable SSO for any Pardot users that also have a Salesforce login.
- If you’re not already using User Sync, give it another look in late July and consider enabling it.
- Review any integrations you have. Pardot is updating the WordPress plug-in. 3rd party tools will need to update their own integrations. If you have any custom integrations, start talking to a developer about the upgrade path.
What questions do you have about sunsetting Pardot only users? Anything I missed in this article? Let us know in the comments!
I think it should be pointed out that we shouldn’t make any changes to our user logins for our current Pardot API connections.
We will want to coordinate those changes with our API integration providers as it will take time for them to make the switch and may see some requiring the login change before others even support it.
Will there be an option to disable SSO for an account that we are using for an API integration with another tool?
After Feb 2021, no. All logins will be required to be Salesforce SSO.
We don’t need to do Salesforce SSO now.
We can use either login types right now for another half year. It;s time to start moving over to SSO as our API integration tools have it available.
I am not going to start panicking until the new year.
Are you sure? The post above says “To support customers with Pardot-only users who do not need a full Salesforce license, Pardot will be bundling Salesforce Identity licenses with all Pardot editions. The exact number of bundled licenses is still being finalized, but it will cover the needs of nearly all Pardot customers. These licenses will be backfilled into all existing customer orgs later this year.” It’s not going to leave Pardot only customers high and dry.
Megan, if I understood correctly, this just means that users that currently do not have a Salesforce license will still be able to use Pardot since they will get an Identity license, which will allow them to use Pardot. Nevertheless, they will need to use SSO to authenticate. Thus, all calls to Salesforce/Pardot APIs will soon have to use SSO.
Well said!
I am a Pardot admin for my company and have my own Pardot user name and password, but I use a shared Salesforce account to sign in to Salesforce. I don’t do as much work in Salesforce, but I still need to get in there every day, several times a day. What must I do? How am I affected? Thanks.
Your Pardot user will need to be mapped to a Salesforce user, and single sign-on must be enabled. That will be the only way to access Pardot going forward, so it’s essential that part is completed. If all you need is Pardot, ask that your Salesforce admin create a Salesforce user seat with an Identity license for you, map that new Salesforce user to your existing Pardot seat, and enable single sign-on.
If you need ongoing access to many features in Salesforce, as a best practice from a security perspective, you would want to get a dedicated Salesforce user seat with a license that covers all the things you need to do. Then map that user to your existing Pardot user and enable single sign-on.
This article helped me so much. Thank you, Andrea & The Spot for Pardot!
The old way of logging into Pardot required that I use a separate email address for each instance of Pardot that I needed access to (e.g., Client X + Client Y). With the new SSO method, does anyone know for certain if I still need unique email addresses – or if this new method solves this issue?