13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
Key Takeaways
- Activation History and Run Logs provide transparent visibility into publishing jobs, detailing execution status, start/end timestamps, records evaluated, records exported, and records rejected.
- A missing or null Contact Point value is the most prevalent cause of activation record rejections, occurring when a qualifying unified profile lacks an address corresponding to the target communication channel.
- Data Cloud automatically suppresses audience members possessing active privacy opt-outs or consent restrictions (e.g., `HasOptedOutOfEmail = True`), enforcing global regulatory compliance at the egress boundary.
- Syntax and formatting violations—such as malformed email addresses or phone numbers not conforming to the international E.164 standard—lead to rejection by external ad APIs and communication gateways.
- External advertising platforms enforce minimum active match thresholds (such as Google Ads' requirement for 1,000 active matched search users); an activation may succeed technically in Data Cloud while remaining inactive in the ad platform.
13.4 Activation Troubleshooting: Error Logs, Rejection Reasons & Delivery Failures
Quick Answer: When an Activation completes with errors or delivers fewer records than anticipated, consultants must analyze the Activation Run History and audit records across four primary rejection vectors: Missing Contact Points (profiles qualifying for the segment but lacking an email or phone for the selected channel), Consent & Privacy Suppressions (individuals flagged with privacy opt-outs or Do Not Track restrictions), Formatting Violations (invalid email syntax or phone numbers not formatted to international E.164 standards), and External Platform Rejections (expired OAuth credentials, AWS IAM permission errors, or failing to meet Google Ads' 1,000 active matched user threshold). Systematic troubleshooting combines Run Log analysis, Data Explorer verification, and downstream API status inspection.
Monitoring Activation Health: Run Logs & Status Metrics
Every scheduled or manual execution of an Activation generates an immutable entry in the Activation History related list on the Activation record page.
+-------------------------------------------------------------------------------------------------+
| ACTIVATION RUN HISTORY METRICS TABLE |
+-------------------------------------------------------------------------------------------------+
| Metric Name | Description |
+-----------------------+-------------------------------------------------------------------------+
| **Status** | Success, Failed, or Completed with Errors |
| **Start / End Time** | Execution window and overall processing duration |
| **Records Evaluated** | Total qualified audience count delivered by the Segment query |
| **Records Published** | Count of records successfully formatted and transmitted to target |
| **Records Rejected** | Count of records dropped during packaging due to errors or suppressions |
| **Error Message / Code| Specific diagnostic message returned by internal engine or external API |
+-------------------------------------------------------------------------------------------------+
Interpreting Activation Statuses:
- Success: The segment was evaluated, contact points resolved, payload attributes packaged, and all records transmitted successfully to the target endpoint with zero rejections.
- Completed with Errors: The activation job finished and published records, but a subset of records was dropped (e.g., 50,000 evaluated, 42,000 published, 8,000 rejected). This status requires immediate investigation into dropped record causes.
- Failed: The entire publishing job terminated abnormally before data transmission. This typically indicates fatal infrastructure errors: expired external OAuth tokens, revoked AWS IAM bucket policies, or downstream schema mismatch errors.
Common Rejection Reasons & Failure Modes
Consultants must be skilled in identifying why discrepancies exist between the Segment Population and the Published Activation Count.
+-------------------------------------------------------------------------------------------------+
| THE 4 RECORD REJECTION VECTORS |
+-------------------------------------------------------------------------------------------------+
1. MISSING CONTACT POINT 2. CONSENT & PRIVACY SUPPRESSION
┌──────────────────────────────┐ ┌──────────────────────────────┐
│ Profile has no Email/Phone │ │ Individual has Opt-Out flag: │
│ on ContactPoint DMO for │ │ - HasOptedOutOfEmail = True │
│ the selected channel. │ │ - Consent restriction logged │
└──────────────────────────────┘ └──────────────────────────────┘
│ │
▼ ▼
[ 50,000 Segment Members ] ────────► [ 41,500 Published Records ]
▲ ▲
│ │
3. FORMATTING / SYNTAX ERROR 4. EXTERNAL PLATFORM GATEWAY
┌──────────────────────────────┐ ┌──────────────────────────────┐
│ - Invalid Email regex │ │ - Google Ads < 1,000 users │
│ - Non-E.164 Phone format │ │ - Expired Meta Token │
│ - Over-length text string │ │ - S3 KMS Access Denied │
└──────────────────────────────┘ └──────────────────────────────┘
+-------------------------------------------------------------------------------------------------+
1. Missing or Null Contact Points
This is the single most common reason for record rejection. A segment query operates on the Unified Individual entity based on business criteria (e.g., "Customers who purchased over $500 in the last 6 months"). A customer may fully qualify for this behavioral segment, but if the activation is configured for an Email channel and that unified profile has no associated ContactPointEmail record, Data Cloud cannot deliver the record. The system drops the record and logs a missing contact point rejection.
2. Consent Management & Privacy Suppressions
Salesforce Data Cloud incorporates privacy-by-design at the activation boundary. If an organization harmonizes consent records into the Individual or ContactPointConsent DMOs:
- If an individual's
HasOptedOutOfEmailattribute is set toTrue, Data Cloud automatically suppresses that individual from email activations. - If an individual has logged a global Right to be Forgotten (RTBF) or privacy restriction request, the profile is excluded from all outbound activation payloads.
- These suppressions are recorded as dropped/rejected records to ensure full legal compliance with GDPR, CCPA/CPRA, and CASL regulations.
3. Syntax and Data Formatting Rejections
Downstream communication vendors and ad networks enforce strict schema syntax validation:
- Phone Number E.164 Compliance: External SMS providers and advertising APIs require international E.164 formatting (e.g.,
+14155552671including the country code, with no dashes, parentheses, or spaces). If phone numbers in the source system contain raw local strings (e.g.,(415) 555-2671), external APIs reject the record. - Email Syntax Validation: Strings missing
@symbols, containing invalid domain extensions, or containing unsupported whitespace/special characters fail RFC 5322 validation and are dropped.
4. External Platform API & Infrastructure Failures
When an activation fails entirely, the issue typically resides in the external target's authentication or environmental configuration:
- AWS S3 Access Denied (KMS Encryption): Data Cloud may possess valid S3 bucket permissions (
s3:PutObject), but if the S3 bucket is encrypted with an AWS Key Management Service (AWS KMS) customer-managed key, the IAM role must also have explicit permissions (kms:GenerateDataKeyandkms:Decrypt). Without KMS permissions, the activation job fails instantly upon file write. - Expired Advertising OAuth Handshake: Meta Ads and Google Ads OAuth tokens expire periodically or when administrative passwords change. An expired token causes API requests to fail with HTTP 401 Unauthorized errors.
- Google Ads Minimum Active User Threshold: Google Ads Customer Match requires a minimum of 1,000 active matched users across Google Search, YouTube, or Gmail before campaigns can serve ads. If an activation publishes 600 records, Data Cloud reports
Success(because the API call succeeded), but Google Ads shows the list as "Inactive / Too small to serve".
Systematic 5-Step Troubleshooting Methodology
When diagnosing an activation issue, follow this structured consultant methodology:
+-------------------------------------------------------------------------------------------------+
| CONSULTANT 5-STEP TROUBLESHOOTING WORKFLOW |
+-------------------------------------------------------------------------------------------------+
| Step 1: Review Activation Run Logs & Error Codes |
| - Inspect Records Evaluated vs. Records Published vs. Records Rejected. |
| - Check the error summary string on the failed execution record. |
+-------------------------------------------------------------------------------------------------+
│
▼
+-------------------------------------------------------------------------------------------------+
| Step 2: Validate Contact Point Availability via Data Explorer |
| - Query the Unified Individual and linked ContactPoint DMOs in Data Explorer. |
| - Confirm whether rejected profiles have valid, populated email/phone records. |
+-------------------------------------------------------------------------------------------------+
│
▼
+-------------------------------------------------------------------------------------------------+
| Step 3: Audit Consent & Privacy Flags |
| - Inspect the Individual DMO and ContactPointConsent records for opt-out flags. |
| - Verify whether privacy suppression rules are actively filtering qualifying members. |
+-------------------------------------------------------------------------------------------------+
│
▼
+-------------------------------------------------------------------------------------------------+
| Step 4: Validate Destination Authentication & Storage Permissions |
| - Verify OAuth connection health in Data Cloud Setup. |
| - Test AWS IAM Role ARN, S3 bucket policies, and KMS encryption key permissions. |
+-------------------------------------------------------------------------------------------------+
│
▼
+-------------------------------------------------------------------------------------------------+
| Step 5: Verify Downstream Platform Ingestion & Thresholds |
| - Log into Marketing Cloud Engagement Contact Builder or Google Ads Audience Manager. |
| - Validate Shared Data Extension row counts and check ad network active match rates. |
+-------------------------------------------------------------------------------------------------+
Diagnostic Comparison: Failure Symptoms & Solutions
| Symptom | Root Cause | Architectural Remediation |
|---|---|---|
| Records Evaluated = 10,000; Records Published = 0; Status = Failed | Expired OAuth token or revoked IAM Role permissions on destination target | Re-authenticate the Activation Target connector or update AWS IAM/KMS trust policy |
| Records Evaluated = 50,000; Records Published = 35,000; Status = Completed with Errors | 15,000 profiles lack valid Contact Points or have active opt-out flags set | Audit Contact Point mapping; refine segment criteria to require existing contact points |
| Status = Success in Data Cloud, but 0 records found in Marketing Cloud DE | Activation wrote to a Shared Data Extension in a different Business Unit | Verify which Business Units were selected during Activation Target setup |
| Google Ads list shows "List size too small to serve" | Published list has fewer than 1,000 active matched Google users | Expand segment criteria to increase audience volume above Google's 1,000 user floor |
| AWS S3 export fails immediately with "Access Denied" | S3 bucket is KMS-encrypted, but IAM Role lacks kms:GenerateDataKey permissions | Add KMS key permissions to the AWS IAM policy assumed by Data Cloud |
Consultant Deliverability Blueprint: 7 Best Practices
- Always Include Contact Point Filters in Segments: If authoring an email campaign, include a segment rule:
UnifiedIndividual.ContactPointEmail.EmailAddress Is Not Null. This prevents profiles with no email from entering the segment, eliminating artificial rejection spikes in run logs. - Standardize Phone Numbers at Ingestion: Use Formula Fields or Data Transforms during ingestion to normalize phone numbers into the E.164 international standard before data reaches identity resolution.
- Monitor OAuth Token Lifecycles: Establish scheduled administrative calendar audits to review and re-authorize external platform connections (Meta, Google, Azure) before production tokens expire.
- Pre-Validate AWS KMS Policies: When configuring S3 targets with KMS encryption, verify that the customer's AWS key policy explicitly includes the Data Cloud IAM role ARN in its
Key Userslist. - Account for Ad Platform Processing Latency: Educate marketing stakeholders that Google Ads and Meta Ads require 24 to 48 hours after successful Data Cloud activation to match hashes and activate campaigns.
- Test Payloads with Small Cohorts: Before activating a 5-million-member segment with multiple related attributes, test the activation configuration against a 100-member test segment to validate downstream schema and column mapping.
- Enforce Consistent Subscriber Key Conventions: Ensure the identifier chosen as the Subscriber Key matches the existing master identifier in downstream Marketing Cloud Engagement BUs to prevent subscriber record inflation.
A Data Cloud consultant reviews an Activation Run History log for a retail client. The segment contains 120,000 unified individuals, but the run log indicates: 'Records Evaluated: 120,000; Records Published: 98,000; Records Rejected: 22,000; Status: Completed with Errors'. Further analysis shows that 14,000 records were dropped due to 'Missing Contact Point' and 8,000 were dropped due to 'Privacy Restriction / Opt-Out'. What should the consultant recommend to optimize the segment and eliminate unexpected rejection spikes?
An advertising agency configures an activation from Data Cloud to Google Ads Customer Match to support a paid search remarketing campaign. The activation run completes with a status of 'Success' and reports 750 records published. However, 48 hours later, the campaign manager reports that the Google Ads campaign is paused with the status message: 'List size too small to serve'. What is the architectural reason for this issue?
A financial services institution configures an Activation Target to export high-net-worth customer segments to an encrypted AWS S3 bucket. During the first scheduled activation run, the job terminates immediately with the status 'Failed' and logs the error: 'AWS Service Error: Access Denied (Service: Amazon S3; Status Code: 403)'. The AWS cloud engineering team verifies that the IAM Role assumed by Data Cloud has full s3:PutObject and s3:GetObject permissions on the target bucket. What is the most likely root cause of this failure?