Integrating with Salesforce Marketing Cloud for Universal Consent & Preference Management

Important:

OneTrust's authentication process with Salesforce is changing. You can read more about these changes here.

You can quickly and easily establish a connection between Salesforce Marketing Cloud and OneTrust's Universal Consent & Preference Management in order to properly maintain consent records within your CRM.

Best Practices & Things to Know

  • The LastName field is required in order to create a contact in Salesforce.

  • Any field validation limitations in Salesforce apply.

  • Any API limits (100k transactions per day or higher if a higher traffic tier is in use) apply.

  • Consent purposes should point to Boolean values in Salesforce.

  • The following settings must be enabled in your tenant:

    • Under Collection Point settings, enable: Enable Collection Point Events.

    • In order to use any Data Subject Deletion integrations, under Consent Settings on Global Settings, enable: Enable Data Subject Deletion.

  • There are currently two known issues that Salesforce has reported that may affect connection:

    • When using specific workflows created as Native Integration tasks in Consent, certain API calls require the use of PII (Personal Identifiable Information) in the URL path. This affects workflows Profile updated and Consent updated

    • For the Push Consent Updates to Salesforce Leads workflow and Push Consent Updates to Salesforce Contacts workflow:

      • There is a concurrency issue, where we are seeing a few errors in the workflows which leads to creating duplicate records in Salesforce Contacts/Leads

To create a new connected app

  1. In the main navigation menu, click the Gear icon to select Setup. The Setup Home screen appears.

  2. In the sidebar under Platform Tools, click Apps > App Manager. The Setup App Manager screen appears.

  3. Click the New Connected App button. The New Connected App block appears.

  4. Complete the fields and add the following information:

    • Enable OAuth

    • Add Callback URL in the following format: https://<OneTrust Environment FQDN>/integrationmanager/api/v1/tokens/callback. Example: app.onetrust.com for OneTrust Environment FQDN. The exact Callback URL can also be validated and copied from the Credentials screen in the OneTrust app. See the table in To create app credentials in OneTrust



  5. Move the below OAuth Scopes into the Selected OAuth Scopes column:

    1. Access and manage your data (api)

    2. Full access (full)

    3. Perform requests on your behalf at any time (refresh_token, offline_access)


  7. Copy the Consumer Key (Client ID) and click to reveal the Consumer Secret (Client Secret). This will need to be referenced and used in the following steps.


To create a Salesforce Marketing Cloud Integration using Native Integrations

You can set up a connection with Salesforce Marketing Cloud directly in the Universal Consent & Preference Management module using Native Integrations. Native Integrations provide an out-of-the-box method to authenticate into third parties and offer a simplified configuration process by seeding Universal Consent & Preference Management data to easily transfer the data back and forth.

  1. On the Universal Consent & Preference Management menu, select Interfaces > Native Integrations. The Native Integrations screen appears.

  2. Click the Add New button. The Create New Integration modal appears. Enter a name and description then click the Create button. The Integration Details screen appears.


  3. Enter a name and description for the integration. Then click the Create button. The Integration Details screen appears.

  4. Click the Add Task button. The Add Task pane appears.


  5. Select the Salesforce Marketing Cloud system to populate a list of available template connections. Then select a connection using the radio button next to one of the connection names to start the connection wizard. Once selected, click the Next button.

    The following connections are available for Salesforce Marketing Cloud:

    Connection Name

    Description

    Marketing Cloud: Manage Subscribers (DS Profile Deleted)

    Select this connection to delete a data subject profile from Salesforce Marketing Cloud when deleted in OneTrust.

    Marketing Cloud: Manage Subscribers (DS Consent Updated)

    Select this connection to update consent in Salesforce Marketing Cloud when a data subject updates consent in OneTrust.

    Marketing Cloud: Manage Subscribers (DS Profile Updated)

    Select this connection to update a profile in Salesforce Marketing Cloud when a data subject updates their profile in OneTrust.

    Marketing Cloud: Manage Subscriber Lists (DS profile updated)

    Select this connection to update preferences in Salesforce Marketing Cloud when a data subject updates their preferences in OneTrust.
  6. On the Workflow Wizard, enter a name for the connection and enter a valid email address. Then, either create a new credential or select an existing credential from the available list. Click the Test button to verify that the credentials are valid. If valid, a green check mark with a Connected message will appear. Click the Next button when ready.


  7. In the Configure Trigger step, select a value associated with a Collection Point from the Select Value dropdown menu.

    1. Configure the action with parameters, operators, and values to produce the necessary logic. Use the ANY or ALL condition setting within the condition to further customize the sequence criteria.

    2. Click the Add Condition button to add another condition setting within the condition to further customize the sequence criteria.

    3. Click the Add icon to add additional conditions to the initial condition, which is subject to the ANY or ALL selection. Click the Remove icon button to remove the additional condition.

    4. Click the Next button when ready.



  8. In the Mapping step, select an option from the Collection Point Settings dropdown menu, then select a OneTrust Field and a Salesforce Field to map to. Click the Next button when ready.


  9. The Integration Summary screen appears. Here, you can review the workflow mapping, and click the Add button when ready.


To create a Salesforce Integration using Integrations

Privacy Information

Given the way the current integration works, if you choose to establish a connection between Salesforce and OneTrust, there will be identifiers such as an email address that need to be shared and transferred between the OneTrust and Salesforce servers. The identifiers synced between OneTrust and Salesforce are related to a customers’ end users. This only happens when you select the consent updated workflow.                

All of the personal information transferred is rendered in the HTTP body, with the exception of the end users' email addresses which are part of the resource path. Both the HTTP body and resource path are encrypted in transit.

There are, however, security concerns associated with such a transfer because the resource path (which contains end users’ email addresses) may be logged in Salesforce's servers (e.g., for monitoring purposes) which means that personal information could potentially reside in log entries at rest. An example of how this may look is as follows: 

  • https://{sf-host}/services/data/v43.0/sobjects/contact/Email/jdoe@onetrust.com

The risk of exposing email addresses is that they may be seen by intelligence agencies, retrieved by malicious actors, and otherwise misused.  This is a risk that cannot currently be avoided and OneTrust and Salesforce will work to mitigate this going forward.

The basis on which OneTrust is sharing these identifiers with Salesforce is to give effect to the contracts we have in place with our customers who choose to establish a connection between OneTrust and Salesforce. Customers must be aware that such transfer of data comes with risks as further detailed above. Please ensure that you understand and have discussed the above risks with your legal, privacy and security teams before integration.

Please reach out to OneTrust Support with any further questions.