Study guide
13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
Salesforce Certified Data 360 Consultant formerly Data Cloud Consultant
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Solution Overview & Enterprise Value
1.1 Enterprise Customer 360 & Data Cloud Business Value 1.2 Architectural Foundation: Zero-Copy, Hyperforce, Lakehouse & Data Pipeline 1.3 Platform Terminology, Core Entities & Data Lifecycle Stages 1.4 Data 360's Foundational Role in Predictive & Generative AI
2 Chapter 2: Ethics, Privacy & Governance Fundamentals
2.1 Regulatory Compliance, Data Privacy & Ethics in Customer Data 2.2 Consent Management & Preference Enforcement in Data Cloud 2.3 Data Retention, Deletion, and Privacy Right-to-be-Forgotten (RTBF)
3 Chapter 3: Security, Permissions & Tenant Architecture
3.1 Standard Permission Sets, User Roles & Functional Access 3.2 Data Spaces Architecture, Resource Allocation & Tenant Isolation
4 Chapter 4: Administration, Monitoring & Lifecycle Management
4.1 Data Kits & Package Automation for Cross-Org Deployment 4.2 Auditing, Status Monitoring, Error Logs & Data Explorer 4.3 Sandboxes, Change Management & Metadata Deployment
5 Chapter 5: Ingestion Connectors & Source Integration
5.1 Standard Bundles & Salesforce CRM Connectors (Sales/Service/Marketing) 5.2 Cloud Storage (S3, GCS, Azure Blob) & Streaming Ingestion (Web/Mobile SDK, Ingestion API) 5.3 Zero-Copy Data Federation & Snowflake/BigQuery/Databricks Sharing
6 Chapter 6: Data Lake Objects (DLO) & Data Transformations
6.1 DLO Configuration, Primary Keys, Event Time & Data Stream Categories (Profile, Engagement, Other) 6.2 Streaming & Batch Data Transforms: Formula Fields, SQL Transforms & Data Prep Recipes
7 Chapter 7: Data Model Objects (DMO) & Canonical Harmonization
7.1 Customer 360 Canonical Data Model & Subject Areas 7.2 DLO-to-DMO Mapping Patterns, Cardinality & Custom DMO Design 7.3 Data Validation, Schema Maintenance & Field Mapping Best Practices
8 Chapter 8: Identity Resolution Architecture & Match Rules
8.1 Identity Resolution Concepts, Consolidation Rate & Graph Modeling 8.2 Match Rules & Match Criteria: Exact Match vs. Fuzzy Matching (Deterministic & Probabilistic) 8.3 Multi-Party Identification, Anonymous-to-Known Transitions & Contact Point Matching
9 Chapter 9: Reconciliation Rules & Unified Profile Governance
9.1 Reconciliation Rules: Most Frequent, Source Priority & Last Updated 9.2 Unified Profile Schema (Individual & Contact Points) & Resolution Troubleshooting
10 Chapter 10: Segment Architecture & Audience Design
10.1 Segmentation Canvas, Segment Types (Standard UI & Flow) & Query Processing 10.2 Direct vs. Related Attributes, Cardinality & 1:N Filtering Traps 10.3 Segment Schedule, Refresh Frequencies & Exclusion Logic 10.4 Segment Membership Analysis, Population Drift & Sizing Validation
11 Chapter 11: Calculated & Streaming Insights
11.1 Calculated Insights (CI) Architecture, SQL/Builder Syntax & Dimensions vs. Metrics 11.2 Streaming Insights (SI) Architecture, Windowing (Tumbling/Sliding) & Real-Time Signals 11.3 CI vs. SI Architectural Decision Matrix & Performance Optimization
12 Chapter 12: Data Enhancements, Sharing & Analysis
12.1 Referencing Data 360 Data from Other Systems: Enrichments, Related Lists, Data Graphs & APIs 12.2 Reports, Dashboards & Tableau Analysis on Data 360 Data 12.3 Applying Predictive & Generative AI Tooling to Customer Scenarios
13 Chapter 13: Activation Targets & Outbound Activation
13.1 Activation Targets: Marketing Cloud, External Platforms, Cloud Storage & Data Spaces 13.2 Activation Configuration: Audience Mapping, Related Attributes & Payload Optimization 13.3 Activation Schedules, Publishing Cadence & Incremental vs. Full Refresh 13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
14 Chapter 14: Real-Time Data Actions & Flow Automation
14.1 Data Action Targets & Webhook/Platform Event Architecture 14.2 Data Cloud-Triggered Flows & Real-Time Business Orchestration 14.3 End-to-End Enterprise Scenario Walkthrough: Ingestion to Closed-Loop Action
13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
Key Takeaways Explain This Topic AI
Activation History and Run Logs provide transparent visibility into publishing jobs, detailing execution status, start/end timestamps, records evaluated, records exported, and records rejected.
A missing or null Contact Point value is the most prevalent cause of activation record rejections, occurring when a qualifying unified profile lacks an address corresponding to the target communication channel.
Data Cloud automatically suppresses audience members possessing active privacy opt-outs or consent restrictions (e.g., HasOptedOutOfEmail = True ), enforcing global regulatory compliance at the egress boundary.
Syntax and formatting violations—such as malformed email addresses or phone numbers not conforming to the international E.164 standard—lead to rejection by external ad APIs and communication gateways.
External advertising platforms enforce minimum active match thresholds (such as Google Ads' requirement for 1,000 active matched search users); an activation may succeed technically in Data Cloud while remaining inactive in the ad platform.
Last updated: September 2026
13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
Quick Answer: When an Activation completes with errors or delivers fewer records than anticipated, consultants must analyze the Activation Run History and audit records across four primary rejection vectors: Missing Contact Points (profiles qualifying for the segment but lacking an email or phone for the selected channel), Consent & Privacy Suppressions (individuals flagged with privacy opt-outs or Do Not Track restrictions), Formatting Violations (invalid email syntax or phone numbers not formatted to international E.164 standards), and External Platform Rejections (expired OAuth credentials, AWS IAM permission errors, or failing to meet Google Ads' 1,000 active matched user threshold). Systematic troubleshooting combines Run Log analysis, Data Explorer verification, and downstream API status inspection.
Monitoring Activation Health: Run Logs & Status Metrics
Every scheduled or manual execution of an Activation generates an immutable entry in the Activation History related list on the Activation record page. +-------------------------------------------------------------------------------------------------+
- | ACTIVATION RUN HISTORY METRICS TABLE |
- +-------------------------------------------------------------------------------------------------+
- | Metric Name | Description |
- +-----------------------+-------------------------------------------------------------------------+
- | **Status** | Success, Failed, or Completed with Errors |
- | **Start / End Time** | Execution window and overall processing duration |
- | **Records Evaluated** | Total qualified audience count delivered by the Segment query |
- | **Records Published** | Count of records successfully formatted and transmitted to target |
- | **Records Rejected** | Count of records dropped during packaging due to errors or suppressions |
- | **Error Message / Code| Specific diagnostic message returned by internal engine or external API |
- +-------------------------------------------------------------------------------------------------+
Interpreting Activation Statuses:
Success: The segment was evaluated, contact points resolved, payload attributes packaged, and all records transmitted successfully to the target endpoint with zero rejections.
Completed with Errors: The activation job finished and published records, but a subset of records was dropped (e.g., 50,000 evaluated, 42,000 published, 8,000 rejected). This status requires immediate investigation into dropped record causes.
Failed: The entire publishing job terminated abnormally before data transmission. This typically indicates fatal infrastructure errors: expired external OAuth tokens, revoked AWS IAM bucket policies, or downstream schema mismatch errors.
Common Rejection Reasons & Failure Modes
Consultants must be skilled in identifying why discrepancies exist between the Segment Population and the Published Activation Count . +-------------------------------------------------------------------------------------------------+
- | THE 4 RECORD REJECTION VECTORS |
- +-------------------------------------------------------------------------------------------------+
- 1. MISSING CONTACT POINT 2. CONSENT & PRIVACY SUPPRESSION
- ┌──────────────────────────────┐ ┌──────────────────────────────┐
- │ Profile has no Email/Phone │ │ Individual has Opt-Out flag: │
- │ on ContactPoint DMO for │ │ - HasOptedOutOfEmail = True │
- │ the selected channel. │ │ - Consent restriction logged │
- └──────────────────────────────┘ └──────────────────────────────┘
- │ │
- ▼ ▼
- [ 50,000 Segment Members ] ────────► [ 41,500 Published Records ]
- ▲ ▲
- │ │
- 3. FORMATTING / SYNTAX ERROR 4. EXTERNAL PLATFORM GATEWAY
- ┌──────────────────────────────┐ ┌──────────────────────────────┐
- │ - Invalid Email regex │ │ - Google Ads < 1,000 users │
- │ - Non-E.164 Phone format │ │ - Expired Meta Token │
- │ - Over-length text string │ │ - S3 KMS Access Denied │
- └──────────────────────────────┘ └──────────────────────────────┘
- +-------------------------------------------------------------------------------------------------+
- 1. Missing or Null Contact Points
This is the single most common reason for record rejection. A segment query operates on the Unified Individual entity based on business criteria (e.g., "Customers who purchased over $500 in the last 6 months"). A customer may fully qualify for this behavioral segment, but if the activation is configured for an Email channel and that unified profile has no associated ContactPointEmail record, Data Cloud cannot deliver the record. The system drops the record and logs a missing contact point rejection.
2. Consent Management & Privacy Suppressions
Salesforce Data Cloud incorporates privacy-by-design at the activation boundary. If an organization harmonizes consent records into the Individual or ContactPointConsent DMOs:
If an individual's HasOptedOutOfEmail attribute is set to True , Data Cloud automatically suppresses that individual from email activations.
If an individual has logged a global Right to be Forgotten (RTBF) or privacy restriction request, the profile is excluded from all outbound activation payloads.
These suppressions are recorded as dropped/rejected records to ensure full legal compliance with GDPR, CCPA/CPRA, and CASL regulations.
3. Syntax and Data Formatting Rejections
Downstream communication vendors and ad networks enforce strict schema syntax validation:
Phone Number E.164 Compliance: External SMS providers and advertising APIs require international E.164 formatting (e.g., +14155552671 including the country code, with no dashes, parentheses, or spaces). If phone numbers in the source system contain raw local strings (e.g., (415) 555-2671 ), external APIs reject the record.
Email Syntax Validation: Strings missing @ symbols, containing invalid domain extensions, or containing unsupported whitespace/special characters fail RFC 5322 validation and are dropped.
4. External Platform API & Infrastructure Failures
When an activation fails entirely, the issue typically resides in the external target's authentication or environmental configuration:
AWS S3 Access Denied (KMS Encryption): Data Cloud may possess valid S3 bucket permissions ( s3:PutObject ), but if the S3 bucket is encrypted with an AWS Key Management Service (AWS KMS) customer-managed key, the IAM role must also have explicit permissions ( kms:GenerateDataKey and kms:Decrypt ). Without KMS permissions, the activation job fails instantly upon file write.
Expired Advertising OAuth Handshake: Meta Ads and Google Ads OAuth tokens expire periodically or when administrative passwords change. An expired token causes API requests to fail with HTTP 401 Unauthorized errors.
Google Ads Minimum Active User Threshold: Google Ads Customer Match requires a minimum of 1,000 active matched users across Google Search, YouTube, or Gmail before campaigns can serve ads. If an activation publishes 600 records, Data Cloud reports Success (because the API call succeeded), but Google Ads shows the list as "Inactive / Too small to serve".
Systematic 5-Step Troubleshooting Methodology
When diagnosing an activation issue, follow this structured consultant methodology: +-------------------------------------------------------------------------------------------------+
- | CONSULTANT 5-STEP TROUBLESHOOTING WORKFLOW |
- +-------------------------------------------------------------------------------------------------+
- | Step 1: Review Activation Run Logs & Error Codes |
- | - Inspect Records Evaluated vs. Records Published vs. Records Rejected. |
- | - Check the error summary string on the failed execution record. |
- +-------------------------------------------------------------------------------------------------+
- │
- ▼
- +-------------------------------------------------------------------------------------------------+
- | Step 2: Validate Contact Point Availability via Data Explorer |
- | - Query the Unified Individual and linked ContactPoint DMOs in Data Explorer. |
- | - Confirm whether rejected profiles have valid, populated email/phone records. |
- +-------------------------------------------------------------------------------------------------+
- │
- ▼
- +-------------------------------------------------------------------------------------------------+
- | Step 3: Audit Consent & Privacy Flags |
- | - Inspect the Individual DMO and ContactPointConsent records for opt-out flags. |
- | - Verify whether privacy suppression rules are actively filtering qualifying members. |
- +-------------------------------------------------------------------------------------------------+
- │
- ▼
- +-------------------------------------------------------------------------------------------------+
- | Step 4: Validate Destination Authentication & Storage Permissions |
- | - Verify OAuth connection health in Data Cloud Setup. |
- | - Test AWS IAM Role ARN, S3 bucket policies, and KMS encryption key permissions. |
- +-------------------------------------------------------------------------------------------------+
- │
- ▼
- +-------------------------------------------------------------------------------------------------+
- | Step 5: Verify Downstream Platform Ingestion & Thresholds |
- | - Log into Marketing Cloud Engagement Contact Builder or Google Ads Audience Manager. |
- | - Validate Shared Data Extension row counts and check ad network active match rates. |
- +-------------------------------------------------------------------------------------------------+
- Diagnostic Comparison: Failure Symptoms & Solutions
Symptom Root Cause Architectural Remediation
Records Evaluated = 10,000; Records Published = 0; Status = Failed Expired OAuth token or revoked IAM Role permissions on destination target Re-authenticate the Activation Target connector or update AWS IAM/KMS trust policy
Records Evaluated = 50,000; Records Published = 35,000; Status = Completed with Errors 15,000 profiles lack valid Contact Points or have active opt-out flags set Audit Contact Point mapping; refine segment criteria to require existing contact points
Status = Success in Data Cloud, but 0 records found in Marketing Cloud DE Activation wrote to a Shared Data Extension in a different Business Unit Verify which Business Units were selected during Activation Target setup
Google Ads list shows "List size too small to serve" Published list has fewer than 1,000 active matched Google users Expand segment criteria to increase audience volume above Google's 1,000 user floor
AWS S3 export fails immediately with "Access Denied" S3 bucket is KMS-encrypted, but IAM Role lacks kms:GenerateDataKey permissions Add KMS key permissions to the AWS IAM policy assumed by Data Cloud
Consultant Deliverability Blueprint: 7 Best Practices
Always Include Contact Point Filters in Segments: If authoring an email campaign, include a segment rule: UnifiedIndividual.ContactPointEmail.EmailAddress Is Not Null . This prevents profiles with no email from entering the segment, eliminating artificial rejection spikes in run logs.
Standardize Phone Numbers at Ingestion: Use Formula Fields or Data Transforms during ingestion to normalize phone numbers into the E.164 international standard before data reaches identity resolution.
Monitor OAuth Token Lifecycles: Establish scheduled administrative calendar audits to review and re-authorize external platform connections (Meta, Google, Azure) before production tokens expire.
Pre-Validate AWS KMS Policies: When configuring S3 targets with KMS encryption, verify that the customer's AWS key policy explicitly includes the Data Cloud IAM role ARN in its Key Users list.
Account for Ad Platform Processing Latency: Educate marketing stakeholders that Google Ads and Meta Ads require 24 to 48 hours after successful Data Cloud activation to match hashes and activate campaigns.
Test Payloads with Small Cohorts: Before activating a 5-million-member segment with multiple related attributes, test the activation configuration against a 100-member test segment to validate downstream schema and column mapping.
Enforce Consistent Subscriber Key Conventions: Ensure the identifier chosen as the Subscriber Key matches the existing master identifier in downstream Marketing Cloud Engagement BUs to prevent subscriber record inflation.