We need to provide access to the following:

  1. A list of all users, their status roles, permissions, and basic info (user name, email, business unit, etc.)
  2. A list of all permissions
  3. A list of all roles
  4. Relation between roles and permissions
  5. Relation between users and roles
  6. Relation between users and roles (this is relevant due to custom permission options that are out of the scope of the role)

We can use REST API, SOAP API, AMPScript, or SQL quarry. Or whatever is suggested.

I was only able to access the AccountUser object using SOAP API. But it doesn't have all the info I need.

For instance in case of a custom permission I get this: Individual role for XXX Individual role for XXX Individual role for XXX>

Maybe some of the information can be found under PermissionSet object, but it is not retrievable.

Any idea how to gain access to the needed information?

Here are the sources I found related so far but was not enough to solve this conundrum:

  1. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/accountuser.html
  2. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/permissionset.html
  3. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/supported_operations_for_objects_and_methods.html?fireglass_rsn=true.html#fireglass_params&tabid=ac297959fcac2f8e&application_server_address=firegtiep04.hq.corp.phoenix.co.il&popup=true&is_right_side_popup=false&start_with_session_counter=1
  4. Retrieving User Details using SOAP API
  5. Read AccountUser's assigned to BusinessUnit in Enterprise Account
  6. User Permission Access Report
  7. https://help.salesforce.com/s/articleView?id=sf.mc_overview_enterprise_user_permissions.htm&type=5


Following the commenters, I have tried to retrieve AccountUsers from the BusinessUnit Object using SSJS WSProxy. But no I'm getting an error: The Request Property(s) AccountUsers do not match with the fields of BusinessUnit retrieve

This corresponds to the described Object check I did, AccountUsers cannot be retrieved.

Note: This was executed using a cloud page on the top parent BU.

Retrieve code:

var prox = new Script.Util.WSProxy();

try {
    var soapObject = "BusinessUnit";
    var colsArr    = ["Name", "IsActive", "ParentName", "AccountUsers"];
    var res   = prox.retrieve(soapObject, colsArr);

    if (res.Status == "OK") {
        Write("res.Status = "+ res.Status);
} catch (error) {
  • I have documented my solution on my SFMC Dev Blog: charliefay.medium.com/…
    – charliefay
    Jul 3, 2022 at 12:20
  • @charliefay, thanks! but I'm not sure this will solve the custom permission issue (i.e checked not via a role). I have tested an API call to the same object AccountUser. when custom permission was retrieved I got this: Individual role for XXX...
    – yoni349
    Jul 3, 2022 at 13:12
  • ahh Yes I also get the Individual role for {accountUserId} from the Roles soap object. I will try digging for individual user permission. Also, side note, something to be aware of if you're looking into Roles object via the API: salesforce.stackexchange.com/questions/350736/…
    – charliefay
    Jul 3, 2022 at 21:54

1 Answer 1


I've built something similar to what you've described.

I went through all of @charliefay's material on this (and thank you). It didn't provide the custom roles -- as you've found.

I spent more than 2 months enduring lame SF Support responses and the crappy API documentation, but I finally figured out.

Here are a few hints:

  • First, do not trust any of the documentation about what SOAP properties are available or retrievable. Do a DESCRIBE on each object using Postman, get all of the property names and do a RETRIEVE on all of them. Let the actual web service endpoint tell you which ones aren't actually retrievable. You'll be surprised at the disparity.
  • The BusinessUnit.AccountUsers property from the parent BU is the most accurate source of AccountUser data that I found.
  • Mirror the raw from the BusinessUnit and AccountUser SOAP objects into data separate extensions.
  • Build an AccountUser_Roles data extension and fill it with Roles from BusinessUnit[x].AccountUsers[y].Roles[z]
  • Permissions is a huge and ultimately meaningless data-set that is way to granular to try to audit or manage. I ended up just sticking to BusinessUnit, AccountUser and AccountUser_Roles.
  • Write a SQL Query to join and/or denormalize the data into the desired output.

Hope this gets you on the right track.


Here's a sample Describe for BusinessUnit:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
        <a:Action s:mustUnderstand="1">Create</a:Action>
        <a:To s:mustUnderstand="1">{{soapEndpoint}}</a:To>
        <fueloauth xmlns="http://exacttarget.com">{{accessToken}}</fueloauth>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <DefinitionRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
  • Hi Adam. I couldn't find any template for Describe action. Can you refer me a sample one? I tried to use WSProxy to describe the BusinessUnit object and AccountUsers property is not retrievable. It's the same with AccountUser and its property BusinessUnit. I wonder how you link between these 2 soap objects?
    – Duc Le
    Jul 5, 2022 at 9:58
  • Thanks, but won't this keep me with the same issue of assigning permission manually not via a role. I'm getting now: <Individual role for XXX> under the permission
    – yoni349
    Jul 5, 2022 at 12:01
  • @yoni349 -- I found this method will return the actual custom Role name instead of Individual role for XXX. Jul 5, 2022 at 12:52
  • @duyduc27 even if the property value is marked as "not retrievable" try to retrieve it. I've confirmed that you can retrieve the AccountUsers.AccountUserID from the BusinessUnit object using WSProxy. Jul 5, 2022 at 15:07
  • @AdamSpriggs, I'm getting an error when trying to retrieve AccountUsers The Request Property(s) AccountUsers do not match with the fields of BusinessUnit retrieve. I have added an edit with the code to the post. So maybe it's been updated to no retrieve now?
    – yoni349
    Jul 6, 2022 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .