One of the most common troubleshooting techniques we recommend in support when you encounter sync issues between Marketo and Salesforce is to log into Salesforce directly as the sync user for your instance.
Some people don't realize that this is an actual user account in their SFDC instance, and that it's possible to sign into Salesforce as that user. Most often this user account is created specifically for Marketo, but sometimes your sync user may be one of your co-workers or employees. We do't recommend this, as there can be complications with your sync if that person leaves the company or if you decide to limit Marketo's visibility into your Salesforce instance. In that case you would be limiting the visibility for that person, who may use the account to do their own work.
The actions you perform in Marketo that effect objects in Salesforce will be accomplished in Salesforce by your sync user. This means that if the sync user profile does not have the permissions necessary to see or interact with some objects in Salesforce, you will receive errors in Marketo when you try to perform actions related to those objects. These same errors would be given for any Salesforce user attempting to perform the same actions, but in this case the error is passed to Marketo, and displayed there.
Some common Salesforce errors you may see in Marketo are:
INSUFFICIENT_ACCESS_OR_READONLY: insufficient access rights on object id
INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY: insufficient access rights on cross-reference id
INVALID_CROSS_REFERENCE_KEY: invalid cross reference id\n
These are not the only errors you might see, but they give you an idea of what a Salesforce error would look like.
When you see these errors, gather as much information in Marketo about the action that caused Salesforce to return them.
What lead or contact was Marketo trying to work with? What flow step or campaign did they go through that may have tried to update or insert information in Salesforce?
Look at the lead's activity history to see what was happening at the time of the error. Check through any campaign results where the error might have originated. All of this will help you to troubleshoot on the Salesforce side. You'll also want to look at the SFDC id for any lead records getting this error, so you'll be able to search for them specifically in SFDC. Use this to verify it's the exact same record you're seeing in Marketo, and not a duplicate. You can find the Id on the Lead tab in the Lead record in Marketo.
After you have as much information about what actions in Marketo caused the error to be returned from Salesforce then you can log into Salesforce.com as your sync user. You can find the sync username in the Salesforce section in Marketo Admin, but you'll have to get the password from your Salesforce admin if you don't know it already.
This may also lead you to find that the sync user credentials are not correct, and that's the cause of your sync troubles. In that case, you'll want to go to Marketo Admin > Salesforce and click Disable sync at the top. That will stop Marketo from trying to sign in over and over while you get the credentials reset. You'll need to reset your sync user's password and security token in Salesforce, and then re-enter that information in Marketo before re-enabling the sync.
Once you get logged in as your sync user, try performing the same actions that you were attempting in Marketo. Search for the same leads/contacts, try to change the same fields and values. This should lead to an error message you can use to figure out what permissions need to be adjusted in Salesforce in order to allow the sync user to perform the actions that are being requested from within Marketo.
If you can't find the leads you're looking for, or edit the fields you're working with, then it's possible the sync user can't even see them, and you can work with your SFDC admin or SFDC support to find out why.
.png)