Pardot Knowledge Base

Mapping Salesforce and Pardot Usernames and Single Sign-On

Last Updated: Apr 07, 2017 | Print this Article

Associating CRM usernames with Pardot users has two major functions: allowing for Single Sign-On (SSO) between Pardot and Salesforce, and allowing any actions that the Pardot connector user takes to be attributed to that user.

Note: Single Sign-On can be used with any Salesforce license type. If you have Pardot users who do not need access to Salesforce objects and data (like leads and contacts), such as users with a Marketing role, you can create a Salesforce user with a Chatter Free license. Click here for Salesforce's help article on creating users.

Assigning your Salesforce username to the Pardot connector

Any users with assigned prospects in Pardot should have a CRM Username selected in their user settings (for example, if you are assigning leads to someone in Pardot, they should have a CRM seat too). If a user does not have their CRM username designated, any prospects assigned to them will by default be reassigned to the CRM connector user in Pardot. (Integrating Assignments with Salesforce gives more information on assignment syncing scenarios when a CRM Username is not selected in Pardot.)

To map your Salesforce username to Pardot:

  1. Log in to Pardot.
  2. Navigate to Admin > User Management > Users.
  3. Click on the gear icon to the far right of the appropriate user.
  4. Click Edit.
  5. Scroll down to the bottom of the Edit User box, right under Time Zone.
  6. Select the appropriate Salesforce user from the CRM Username drop-down menu. (The CRM username and the Pardot user account you are editing should be the same person.)
  7. Click Save user.
  8. Repeat for all users in Pardot that have a corresponding Salesforce user.

Now when you drill into your Pardot user profile, you will see your Salesforce username in the CRM Username field. There will be a "Verify" link next to the username. Click Verify.

Note: Administrators can disable the checkbox “Send Activation Email” to prevent an activation link from being sent to a new user when mapping a new Pardot user to their CRM Username to prevent them from logging into Pardot directly (most common for sales users). By default, email notifications are also automatically enabled when creating a new user. These can be disabled under Preferences if needed. When a User has not activated their account, it is recommended to enable SSO on their behalf in order for them to view an iframe in a lead or contact record in Salesforce.

Note: Users records in Pardot and Salesforce must be created separately. If you have not already set up your users in Pardot, you can do so by following the instructions here.

Setting your Salesforce Pardot Single Sign-on

It is important to set up your Salesforce/Pardot single sign-on as it enables the users to transfer seamlessly between the CRM and Pardot without needing to log into both. This also prevents Salesforce users from having to enter their Pardot username and password in order to view an iframe in a lead or contact record.

Administrators can enable single sign-on for their users in Pardot, either through user import, at the individual user level, or by following these steps. Keep in mind that when using these steps, users who have not already activated their Pardot user seat will not be able to access Pardot directly -- they must gain access to Pardot through the CRM:

  1. Navigate to Admin > User Management > Users.
  2. Use the checkboxes on the left side of the table to select all users you wish to enable single sign-on for.
  3. From the dropdown at the bottom left of the users table, select Enable single sign-on with CRM.
You can also have your users follow these steps, if they wish to enable single sign-on themselves:
  1. Log into Pardot.
  2. Hover over your email address in the top right to see your settings.
  3. Click My Settings
  4. Verify that your CRM username is correct.
  5. If the CRM username is incorrect or absent, click Edit My User Information, then click Link with Salesforce login to change or add it.
  6. If your username is correct, click Verify after the name.
  7. Click Verify.
  8. You will receive a message letting you know whether or not this was successful.
  9. If successful, log into Salesforce and click on the Pardot tab. You should be able to go directly into the application without logging into Pardot separately.
  10. Each of your employees will need to perform these steps to utilize the single sign on. Note that if your Salesforce username or password changes, you will need to make the same change within Pardot.
Note: If an Administrator enables a user's single sign-on before the user has activated their Pardot account, the user's profile will have an alert message reading 'User has activated their account. This user is SSO-only and cannot log in using their email and password.' This means that single sign on users have an activated Pardot account without having a Pardot password. So they appear as activated but are incapable of logging into Pardot normally (from the regular log in screen).

Users must be able to login to Pardot directly to utilize LeadDeck and the Email Plugins. Users marked as SSO-only will not have access to the Email Plugins or LeadDeck.


  • If you use Partner or Customer Portals in Salesforce, you can exclude portal users from your CRM user dropdown by marking Exclude Salesforce "Partner" and "Customer Portal" users from Prospect assignment your Salesforce connector settings.
  • Using Log in with Salesforce does not affect Single Sign-On.
  • If you receive an error message stating that you were unable to verify your single sign-on and you have already confirmed you are using your current Salesforce password, you will need to reach out to your Salesforce administrator to request enabling API access for your Salesforce user account. API access is required to be able to set-up single sign-on.
  • Single Sign-On is not currently compatible with portal users. They will still be able to have leads assigned to them; they just won't be able to take advantage of Single Sign-On.
  • Internet Explorer users may encounter a 3rd-party cookie acceptance issue that prevents Pardot's login cookie from being set. You can either switch to another browser or navigate to Internet Options > Privacy > and adjust the Settings Bar to the lowest "Accept All Cookies" in order for Single Sign-On to work.
  • Internet Explorer 11 (IE 11) users must add to their Trusted sites Security zone. See Microsoft's documentation for instructions.
  • The Chatter Free license is designed for users who don’t have Salesforce licenses but need access to Chatter or to set up Single Sign-On with Pardot. These users can access standard Chatter items such as people, profiles, groups, and files, but they can’t access any Salesforce objects or data.
Next in this series: Testing your Salesforce Connector

Move to a different part in the Salesforce Connector Series:
Part 1: Getting Started
Part 2: Salesforce Configuration
Part 3: Pardot Configuration
Part 4: Advanced Topics

Need more? Start a conversation with other Pardot users in our Success Community