Export, Import & Document SFMC Roles

Backup, clone, and move cross-account the Salesforce Marketing Cloud roles. In seconds.

While you get a set of standard user Roles in Salesforce Marketing Cloud, those are rarely enough. Instead, they are the base on which you can create custom-tailored solutions that align with your business architecture.

You Should Know

The best way to work with Roles and Permissions in Salesforce Marketing Cloud is to leverage standard roles and build on top of them with custom permissions/roles.

On top of that, standard Roles are silently changing from release to release as permissions come and go, so keeping track of them is crucial to have a clear picture of what your users can do.

Marketing Cloud doesn't make it easy. There is no option to clone existing Roles to serve as a starting point for a new custom one. There is no option to export and import them between SFMC accounts. There is no option to create good documentation on them (unless you have a kink for super long print screens).

Here comes JavaScript and Document Object Model (DOM) to unlock all those scenarios.

Fear not - you don't have to be a developer to leverage it. I will describe everything step-by-step and share ready-to-use snippets with you. Let's dive in.

You Should Know

When working with multiple roles or overlapping permissions, be sure to check what is the outcome on the user.

Marketing Cloud goes with the most restrictive resulting permission possible:

If at least one permission (role-based or individual) is set to Deny - the user will not be able to use the feature.
If there is neither Allow nor Deny permission - the user will not be able to use the feature.
If there is at least one Allow permission and not even one Deny permission - the user will be able to use the feature.

You can check the outcome by going to Setup > Users > Users > clicking checkbox next to a user > clicking Manage Roles > Edit Permissions. In this place, you can not only configure individual permissions but also, by expanding to the final permission level, check current result permission along with the source for that state.

Where the magic happens

To start using those SFMC Role-related, DOM-fueled solutions:

Go to Marketing Cloud Setup » Users » Roles.
Click on the name of the Role you want to work with.
Click the expand all Button to see the whole permission tree for the Role.
Right-click any permission name within that tree and select Inspect Element.
This will open a Developer Console in a new part of your browser. Select the Console tab.
[Optional] Click the trash icon visible in the top left or right of the Console (depending on the browser you use) to clean up the working space.
You are ready for the fun!

You Should Know

If any of the solutions described later in this article doesn't work:

Inspect one of the permission names again (either with a right-click or using the aim icon visible on the top left side of the Console).
If above didn't help, refresh the page and go through the steps once more.

Export & Import SFMC Roles

The export and import solution is super helpful when you want to either clone an existing Role and make some changes or move your perfect, tried and tested custom Role to yet another Salesforce Marketing Cloud Account.

It will require a two-step approach.

Exporting an SFMC Role

Access the Console and paste the below code:

Export SFMC role
let permissionsExport = {};
for (const permission of document.querySelectorAll('input[type="checkbox"]')) {
    permissionsExport[permission.id] = permission.checked;
};
console.log(JSON.stringify(permissionsExport));

Click enter to run it.

It will loop through all the checkboxes that you can see next to the permissions, save them in a single JavaScript object and output them to the Console. Yeah, it looks awful, but that's all you need - list of checkboxes along with their status.

Save this long text (either by highlighting and copy-pasting or by right-clicking in an empty space within the Console row and clicking Copy Selected). It should start with { and end with }.

Importing a SFMC Role

Once you have your Role export saved, go to the new Role. It can be either an existing Role you want to overwrite or a new Role (in the same or different SFMC account).

Access the Console and paste the below code:

Import SFMC role
let permissionsImport = {}; // replace {} with the object copied from Export script output
for (const [permissionId, permissionStatus] of Object.entries(permissionsImport)) {
    document.getElementById(permissionId).checked = permissionStatus;
}

Change the {} in the first line with the export text you saved and click enter to run it.

It will loop through all the saved checkboxes and update their state to the one from your export. If some new checkboxes don't exist in the export (for example, you did your export before Marketing Cloud Release that added some new permissions), those new ones will stay unchanged.

That's it. You cloned a Role.

Now, as you can see, the export text was not readable. If you don't want to clone a Role but rather create documentation for it, there is yet another script that is just as easy to use.

Document SFMC Roles

Documenting Roles and Permissions is not easy. You cannot just copy-paste what you see, the HTML is a mess, and the indented names are not unique. Sure, you can print screen it, but that's a lot of checkboxes. And such images aren't accessible documentation. There must be a better way.

And there is, so access the Console and paste the below code:

Create documentation of your SFMC role
let permissions = {};
/* Loop through all permission checkboxes to get their name and state */
for (const permission of document.querySelectorAll('input[type="checkbox"]')) {
    /* Get the lowest-level permission name */
    let permissionName = permission.closest('tr').querySelector('div.PermissionNameText').innerText;

    /* Loop through all levels of permissions to build full path for each permission */
    let permissionContainer = permission.closest('table');
    do {
        permissionContainer = permissionContainer.parentElement.previousElementSibling;
        let permissionParentName = permissionContainer?.querySelector('div.PermissionNameText')?.innerText;
        if (permissionParentName) permissionName = `${permissionParentName} - ${permissionName}`;
    } while (permissionContainer && permissionContainer.id !== 'RolePanel');

    /* Differentiate between Allowed and Denied checkboxes */
    let permissionType = permission.id.startsWith('a') ? 'Allowed' : 'Denied';

    /* Insert permission state into permissions object */
    if (!permissions[permissionName]) permissions[permissionName] = {};
    permissions[permissionName][permissionType] = permission.checked;
};

/* Output permissions in documentation-friendly format (CSV) */
const delimiter = '\t'; // Configure prefered CSV delimiter (tab, comma, pipe, etc.)
let csv = `Permission${delimiter}Allowed${delimiter}Denied\n`; // Headers
/* Loop through permissions object to build a single string for easy copying from console to table */
for (const [permissionName, permissionStatus] of Object.entries(permissions)) {
    csv += `${permissionName}${delimiter}${permissionStatus.Allowed}${delimiter}${permissionStatus.Denied}\n`;
};
/* Clean up uneeded whitespace */
csv = csv.replace(/\n\t/g, '\t').replace(/\n /g, ' ');
console.log(csv);

Click enter to run it.

It will loop through all the checkboxes that you can see next to the permissions and:

Save the permission name (for example, View All Contacts).
Prefix it with all the parent permissions to get a full path (for example, Contacts - Contact Builder - View All Contacts).
Capture the state of Allow and Deny (as a boolean).
Output it to the Console as a single long text with Headers and delimiter of your choice.

The default delimiter is a tab (\t) because it allows you to copy-paste the outcome from Console to a spreadsheet and have it automatically populate the columns. However, depending on your needs, you can change the delimiter variable to something else, like a comma (,) or pipe (|).

Save this long text in its entirety (either by highlighting and copy-pasting or by right-clicking in empty space within the Console row and clicking Copy Selected) - I recommend pushing it straight to a spreadsheet to leverage the autoformatting and filtering capabilities.

Add the Name of the Role and its purpose stored in the Description field, and that's it. You are good to go.

Backup of Standard Roles

As the default System Roles permissions in Salesforce Marketing Cloud can be edited freely and currently there is no easy way to revert those changes, I created a backup repository for you with all out-of-the-box configurations.

SFMC Roles Backup

Where the magic happens​

Export & Import SFMC Roles​

Exporting an SFMC Role​

Importing a SFMC Role​

Document SFMC Roles​

Backup of Standard Roles​

Where the magic happens

Export & Import SFMC Roles

Exporting an SFMC Role

Importing a SFMC Role

Document SFMC Roles

Backup of Standard Roles