Skip navigation
All Places > Products > Blog > Author: John Clark


5 Posts authored by: John Clark Employee

One of the most common troubleshooting techniques we recommend in support when you encounter sync issues between Marketo and Salesforce is to log into Salesforce directly as the sync user for your instance.


Some people don't realize that this is an actual user account in their SFDC instance, and that it's possible to sign into Salesforce as that user. Most often this user account is created specifically for Marketo, but sometimes your sync user may be one of your co-workers or employees. We do't recommend this, as there can be complications with your sync if that person leaves the company or if you decide to limit Marketo's visibility into your Salesforce instance. In that case you would be limiting the visibility for that person, who may use the account to do their own work.


The actions you perform in Marketo that effect objects in Salesforce will be accomplished in Salesforce by your sync user. This means that if the sync user profile does not have the permissions necessary to see or interact with some objects in Salesforce, you will receive errors in Marketo when you try to perform actions related to those objects. These same errors would be given for any Salesforce user attempting to perform the same actions, but in this case the error is passed to Marketo, and displayed there.


Some common Salesforce errors you may see in Marketo are:


INSUFFICIENT_ACCESS_OR_READONLY: insufficient access rights on object id

INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: insufficient access rights on cross-reference id

INVALID_CROSS_REFERENCE_KEY: invalid cross reference id\n


These are not the only errors you might see, but they give you an idea of what a Salesforce error would look like.


When you see these errors, gather as much information in Marketo about the action that caused Salesforce to return them.

What lead or contact was Marketo trying to work with? What flow step or campaign did they go through that may have tried to update or insert information in Salesforce?


Look at the lead's activity history to see what was happening at the time of the error. Check through any campaign results where the error might have originated.  All of this will help you to troubleshoot on the Salesforce side. You'll also want to look at the SFDC id for any lead records getting this error, so you'll be able to search for them specifically in SFDC. Use this to verify it's the exact same record you're seeing in Marketo, and not a duplicate. You can find the Id on the Lead tab in the Lead record in Marketo.


After you have as much information about what actions in Marketo caused the error to be returned from Salesforce then you can log into as your sync user. You can find the sync username in the Salesforce section in Marketo Admin, but you'll have to get the password from your Salesforce admin if you don't know it already.


This may also lead you to find that the sync user credentials are not correct, and that's the cause of your sync troubles.  In that case, you'll want to go to Marketo Admin > Salesforce and click Disable sync at the top.  That will stop Marketo from trying to sign in over and over while you get the credentials reset. You'll need to reset your sync user's password and security token in Salesforce, and then re-enter that information in Marketo before re-enabling the sync.


Once you get logged in as your sync user, try performing the same actions that you were attempting in Marketo. Search for the same leads/contacts, try to change the same fields and values.  This should lead to an error message you can use to figure out what permissions need to be adjusted in Salesforce in order to allow the sync user to perform the actions that are being requested from within Marketo.


If you can't find the leads you're looking for, or edit the fields you're working with, then it's possible the sync user can't even see them, and you can work with your SFDC admin or SFDC support to find out why.

1. "I have a field on a form that won't accept any input or is inaccessible.  Why can't my leads click on the field?"


This is most often due to a layering issue on the landing page.  Each element on the page (forms, pictures, text boxes, etc) has an attribute that decides which layer they sit on.  Your screen is considered layer zero, and each higher layer is like a sheet of glass laid in front of your monitor, getting closer to you as the layer attribute is set higher.  Each element also has a outline that defines how much area it will cover.


Whenever you have a field on one of your forms that doesn't react to mouse clicks, you can check both the layer of the form, and the outlines for the elements around the form.  It's likely that some other element is overlaying the form. (see screenshot)


To fix this, either set your form to a higher layer than surrounding elements, or re-size the outlines for any element that may be overlaying the form.  Re-sizing the outline does not necessarily change the size of the content, so you can move the outline without changing how things look to the end user.



2. "I have a program that won't delete.  It says it's in use."


The easiest way to handle this issue is to look at the Used By view for your program.  Sometimes, even though it doesn't look like the program is in use, there still may be some assets referencing it, which means the system won't allow it to be deleted.  You can see those assets in the Used By list like this:



3. "How do I put a field label inside a form field instead of outside it?"


To do this, you'll use the hint text in your form as your label, and set the label attributes such that there isn't anything for the form to display where the label would usually be.  You'll blank out the Label field and set the Label Width to 0.  Then put whatever text you want to "label" the field with in the hint text (First Name, Last Name, etc).



4. Why did my alert go to the lead when it should have gone to someone else?


The send Alert flow step will only send the alert to those email addresses you provide.  The reason you may see the lead's email address in the footer of the email is because of the standard unsubscribe footer that gets attached to every email that Marketo sends from your instance.  This footer contains a token ({{ address}}), and this token will always populate with the email address of the lead that went through the flow.  This does not mean they were actually sent the email, just that the token in the alert that was sent was populated from their lead record.


You can change the default footer if you like in Admin > Email.



5.  "Why am I getting this error, "Insufficient_Access_Or_Readonly"?


This is a question we often get, but the problem is that this is an error that is originating in Salesforce.  It happens when Marketo tries to update some object (Lead, Contact, etc) in Salesforce, and gets told that the sync user doesn't have the permissions necessary.  This same error would occur for any Salesforce user trying to do something for which they didn't have permissions, it just so happens that in this case it's the sync user, and the error gets displayed in Marketo.


To troubleshoot this, you'll need to work with your Salesforce admin to find out why the sync user was unable to work with the objects named in the error message.

Here are a few of the common things users open support cases for.


1. "I can't see the Calendar in my instance.  How do I get access?"


Each instance of Marketo gets 5 licenses for the Calendar, with the option of adding more if you work with your Account Manager.  In order to use/view the Calendar, a user must first be issued a license in Admin > Users & Roles.  I've included the screenshot below to make it easier to find.



2. "My webinar program shows a Registration Error message when leads try to register."


This kind of error is most often due to a connection issue where Marketo is unable to get a response from the webinar provider servers for some reason.  You can check for these errors in Admin > Launchpoint, and they'll most often show a red X with the error 403.




The first step to troubleshoot this, and the one that most often fixes it, is to re-enter the credentials for your webinar account by double clicking the error.   The credentials you use will need to be for a regular user and cannot be SSO (Single Sign On) integrated.



3. "My system smart list numbers and the pie chart in my database don't match"


This is usually a fairly simple fix.  The pie chart can be updated by clicking anywhere on it, and this will update it with the most current numbers from your database.  I didn't include a screenshot because it just showed a spinning circle.  It only spins for about 5 second usually, but nobody wants to see any more of those than absolutely necessary!



4. "Help! My campaign is running but I need to stop it!"


Sometime you may have a campaign that you thought was ready to go, but after it actually get's activated you notice a typo in the email, or there's a problem with one of your flow steps.  If you absolutely have to stop a batch campaign that is currently running, you can use the abort button in the Campaign Actions menu.  This will stop leads from moving through any more flow steps, but cannot undo those steps that have already been processed, and it cannot un-send any emails that have already been sent.




5. "My Roadshow/Tradeshow program is not showing up on the ipad check-in app."


The check-in app has two conditions for the programs that it will display.  The first is that the program must have been scheduled for any day within a week of today.  That's one week past, and one week in the future.  You can check this in the Schedule tab under Event Actions (see screenshot), or you can look at the information directly on the calendar entry for the program.


The second condition is that both of the statuses in the app need to have been associated with statuses in your program channel.




I hope these help!

You can use Munchkin on any page you like, but the thing to remember if you have multiple products or divisions in your company is that Munchkin cannot automatically track a lead across domains.  This only applies to top level domains though, not sub-domains.  So, a lead could be tracked through


but couldn't automatically be tracked through



So how does munchkin keep track of your leads?


When a lead visits any munchkin tracked page on a domain they've never visited, the system will cookie their browser and create an anonymous lead record in your database.  This allows Marketo to begin gathering and saving information about the lead and their activities even before you know who they are.  It also allows you to begin scoring the lead record, or running them through any other campaigns you might be using to evaluate leads.  Keep in mind that anonymous leads cannot go through all flow steps though(Send Email for instance), and they cannot be made members or a program.  You can see messages about this in the results of any campaign where anonymous leads have qualified for the smart list but couldn't be processed through some steps.


Tracking anonymous leads is a bit like having someone come into your store and look around without really saying or buying anything.  For this reason, it's a good idea to give them a way to tell you who they are.  The main way of course, is by giving them a form they can fill out, which will then convert their anonymous lead record into a known lead record.  Now you can really start to market to them, and you have all of their past activities to see what they've been up to!


Next we'll look at how a lead is tracked if they go to one of your other munchkin tracked pages on another domain.


If our lead from above visits another domain that is being tracked with your munchkin code, the munchkin there will track the lead as anonymous to begin with.  The same process applies to this new anonymous record.  All activity will be recorded, and it can still be scored and acted upon by some flow steps.


If the lead identifies themselves on the new domain by filling out a form using the same email address they previously used on the original domain, then munchkin is able to merge the anonymous record with the original record.  But wait!  There's another way!


Leads can also identify themselves on a new domain by clicking links to that domain in emails that you've sent from Marketo. Each link in your email is wrapped with tracking information specific to the lead the email is sent to, so you can use Marketo to send out invites for known leads to your new store(domain).  By doing this you're saying, "Hey, we know you from our first store, now come visit our new store and let us get to know you there too."  As with the form fill-out, once they click the tracked link Marketo can merge the known and anonymous records and begin tracking the lead's activities in both domains under a single record in Marketo. 


This same process would need to happen for every domain you're using your Munchkin on, in order to track each lead in all domains under a single record.  What we usually recommend is a tagging campaign for each of your domains where you send email(s) from Marketo with a link for each domain. You'd also want to have a form on each domain that leads could fill out.

First, lets start of by establishing how Marketo is able to prefill a form with lead information.


Whenever a lead encounters one of your pages that has munchkin in the source code the cookie in the lead's browser will be read.  If a cookie does not exist, then one will be created and associated with an anonymous record in your database, which will allow the lead to be tracked until they identify themselves.  The cookie makes it possible for the munchkin code to append new tracking activities to the lead's record in your database, and allows any form you have on your page to access the information in the lead record associated with the cookie.


A lead's browser can also be cookied when they interact with emails sent from Marketo.  Each link in emails you send from Marketo gets "wrapped" with tracking information specific to the lead it is sent to.  These links, when clicked, carry the tracking information to their browsers, and the munchkin is able to tell which record the email was sent to.


A form cannot prefill with any information unless there is a Marketo cookie present in the browser.  The trouble is that it's possible for someone to get cookied as or associated with a different lead record.  When this happens, all of their activities will be appended to the new record from then on, until their cookies are deleted.


A lead can be cookied/mis-cookied in a few ways.


1. Lead/User fills out a form.  If they're using their own email address then there's no problem, but if for some reason they'reusing the email address from a different lead record, then they'd be cookied/associated with that record. 


2. Lead/User clicks a tracked link in an email.  As described above, if the email was meant for the lead clicking the link, then there isn't a problem.


3. Lead/User clicks a tracked link copy/pasted from an email.  As I said, links are "wrapped" for the original recipient.  If the link get's copy/pasted anywhere else, the tracking remains the same.  Each new person clicking the link gets cookied as the original recipient and will then see that person's information in a pre-filled form. This is especially common among Coworkers who use Marketo and are testing pages and emails often.


4. Lead/User clicks a tracked link copied/shared from a forwarded email.  Similar to number 3, but instead of the link getting copied somewhere else, the whole email gets forwarded to other people.


5. Lead/User was sent a sales email as part of a mass send from the Outlook or Gmail plugins, which are only designed for 1-to-1 sends.  Sending to multiple email addresses will cause the links to all track to the first person in the To: field, and everyone else gets cookied as that person.


Because of the way Marketo works it's absolutely not possible for someone to see another lead's information unless they have filled out a form using the email address associated with that record, clicked a tracked link meant for another lead, or been part of a batch send from the Outlook or Gmail plugins.  The second is most common, but all of them will cookie the person's browser just as easily.


To prevent this, it's a good idea to use a separate browser for testing, or to clear the cache and cookies of your browser when testing pages/forms/emails.  You can also use Icognito mode if your browser allows it.


At this time it's not possible to dissociate a cookie/browser with a lead record.  Once that connection is made, the only option is to remove the cookie from the browser.

Filter Blog

By date: By tag: