Every Marketo MOPS professional has a dream that one day he or she will be able to build a pristine, well-organized, optimized Marketo instance from scratch. The reality is, most seasoned MOPS professionals are hired to take on instances that, well, are frankly in a state of disarray. When you log in for the first time you will find yourself making mental notes of everything that seems out of place, and creating a massive to-do list in your head– which can be overwhelming.

You can’t attack everything at once, so you’ll need to organize the cleanup and optimization of your instance by breaking down the tasks into categories, and then prioritizing those tasks within each category. My personal cleanup list is a mile long, but these are the five categories I always review first:

  1. Governance
  2. Deliverability
  3. Operational Campaigns and Compliance
  4. Organization and Efficiency
  5. Sync Health

Each category has a long list of individual tasks, but I will highlight the most critical items that you should focus on first.

Task #1: Governance

Your first task as the new sheriff in town is to bring some law and order to the Wild West. One of the most common complaints of MOPS professionals is they are asked to put rules, processes and governance in place, but not given the authority to enforce the rules. If you are stepping into an organization that has had no limits to access, no rules, and no processes, be prepared for pushback. Stand your ground.

Recommended task list:

  1. Verify human users who have access
  2. Verify API integration users that have access
  3. Evaluate level of access (roles)
  4. Make use of expiration of access
  5. Evaluate roles: custom roles for employees and external resources
  6. Refresh of secret keys
  7. Check for external access to Program Library
  8. Verify communication limits
  9. Verify Smart Campaign limits
  10. Verify Email Send campaigns are not set to ignore communications limits

When I was consulting I was amazed at the number of clients who failed to set an expiration date on my access to their Marketo instance, and didn’t delete my account when I finished the contract. If you inherit a Marketo instance that has been managed by multiple people and/or multiple agencies, you’re bound to find a long list of users who have access to Marketo and shouldn’t. Your first task is to evaluate who has access, what level of access they have, and adjust roles and privileges if necessary.

Human User Access of the Marketo Instance

If you are new to a company you’ll need help identifying if any current Marketo users have left the company. Sort the list by Last Login Date. That will tell you immediately who is an active user and who hasn’t logged in for 6 months.

Export the list of users, and ask someone in the know to help you verify who is still at the company. If you identify anyone who is no longer with the company, expire their access or delete them from Marketo immediately. If you identify users from outside agencies that don‘t have a current contract, but may in the future, you can expire their access instead of deleting them.

API Integration User Access

Compare the number of custom integrations and LaunchPoint Partner integrations with the number of API users. If you have multiple integrations but only one API user, you have a problem. They are all sharing the same secret key and access point. Tips for managing API integration users:

  • Create a unique API user for each integration. This is imperative when troubleshooting API errors.
  • Create a policy to refresh the secret key for each API user on an annual basis at a minimum.
  • Delete any API users and integrations that are not currently in use.

It is a huge security risk to allow outside API calls from platforms you no longer use.

Evaluate Roles and Privileges of the Marketo Instance

Marketo has five standard roles:

  1. Admin
  2. Standard User
  3. Marketing User
  4. Web Designer
  5. Analytics User

These roles are not granular enough for most organizations, and are just a starting point.

The three most common mistakes I see in legacy instances are:

  1. Too many admins
  2. No custom roles
  3. No access expiration dates for agencies and contractors

The admin role should only be reserved for the true Marketo database administrators, and no one else. There should always be a minimum of two admins, in case one gets locked out. Any users who are not full time employees (e.g. agencies, contractors) should have access that expires when their contract expires.

Task #2: Deliverability

We’ve all seen the spam emails come in that have a sender that looks like someone we know, but once you expand the header you see that the email was actually sent from a completely different sender address. This is just one of the many issues that can land you in someone’s spam folder, or get you blocked completely.

Recommended task list:

  1. Verify that DKIM (Domain Keys Identified Mail) is set up correctly
  2. Verify that SPF (Sender Policy Framework) is set up correctly
  3. Verify branded tracking link CNAME
  4. Whitelist Marketo server IP addresses
  5. Verify that communication limits are set, and not being overridden
  6. Analyze bounce reasons
  7. Resolve any outstanding spam list issues
  8. Review email templates for deliverability issues
  9. Spot check emails for deliverability issues
  10. Stay up to date on email delivery requirements from the major ISPs.


Without getting too complicated, DKIM provides cryptographic authentication, allowing an email message to be verified by mailbox providers. Getting this set up correctly should be your #1 priority.

Task #3: Operational Campaigns and Compliance

Operational campaigns are created to automate processes that normalize data, manage recurring tasks and keep you in compliance with privacy and data laws.

Recommended task list:

  1. Verify Unsubscribe link is present and functional in all email templates
  2. Verify a Marketing Suspended campaign exists (used for blacklist, competitors, email bounce campaigns, leads in a sales cycle, etc.)
  3. Verify the correct use of base filters in email send campaigns (i.e. suppress people who are Marketing Suspended, invalid email address, etc.)
  4. Email bounces
  5. Normalize data for picklist values
  6. Manage subscriptions
  7. Verify compliance programs exist for GDPR, CASL, CCPA and CAN-SPAM laws

The one thing email compliance laws have in common around the world is that they require a clear and easy way to unsubscribe from marketing emails. Failing to provide a working unsubscribe link in every marketing email you send is an easy way to get marked as spam or land yourself a hefty fine. Make sure the same unsubscribe link is provided in any emails sent by sales programs as well.

Task #4: Organization and Efficiency

If you’ve had a lot of cooks in the kitchen, you probably have a number of different naming conventions or no naming conventions at all. You may also find you have live assets that are totally irrelevant and out of date.

Recommended task list:

  1. Archive retired programs
  2. Deactivate trigger campaigns that are no longer in use
  3. Deactivate recurring batch programs that are no longer in use
  4. Develop a naming convention and stick to it (all assets, including items in the image library, and URLs for landing pages)

Legacy trigger campaigns and Smart Lists that are no longer in use can negatively affect performance of your instance. It is a best practice to deactivate any trigger campaigns once a program is retired. You may or may not want to archive the entire program to prevent it from showing up in searches and reports.

Task #5: CRM Sync Health

Lastly, if you have an instance that is using a native CRM sync supported by Marketo, you can probably use the default settings.

Recommended task list:

  1. Subscribe to Error notifications
  2. Review which custom objects and fields are included in the sync
  3. Check sync backlog
  4. Verify that Marketo can Read and Write to fields it needs access to
  5. Verify  fields important to Sales are visible on Lead, Contact and Account records in your CRM
  6. Check field mapping

Marketo is currently beta testing a CRM sync dashboard for Salesforce and Dynamics. The dashboard contains a lot of useful information regarding the health of your CRM sync, and makes it much easier to surface and troubleshoot sync  issues.

Remember: real change doesn’t happen overnight. If you’ve inherited a Marketo instance that’s anxiety-inducing on first glance, take a step back and breathe. Before the to-do list spirals out of control, organize the necessary tasks into your separate categories. Then, prioritize and execute from there– your instance will begin to shape up before you know it.

Kelly Jo Horton, the author of this guest post, has her MCSA, is a Marketo Champion, and a Fearless 50 member. She is the Principal Engineer of Marketing Operations & Technology at ROOM.