AuthenticatedEmployeeUserName
Returns the login username of the Marketing Cloud user tied to the current context. Runtime-proven on a live Marketing Cloud Engagement CloudPage — a public, anonymous request still gets a non-empty, email-shaped username back, so a non-empty result proves nothing about who is visiting.
Syntax
AuthenticatedEmployeeUserName() → stringParameters
This function takes no parameters.
Example
%%[
VAR @userName
SET @userName = AuthenticatedEmployeeUserName()
]%%
User: %%=v(@userName)=%%
Renders an email-shaped username — on the business unit tested, a dotted name, an @, then a dotted suffix.
Because the value identifies an account user, keep it out of anything a visitor can see and use it only where an internal label is wanted:
%%[
VAR @userName, @isKnown
SET @userName = AuthenticatedEmployeeUserName()
SET @isKnown = IsEmailAddress(@userName)
]%%
%%=v(@isKnown)=%%
What it does not support is a sign-in check — see below.
Return value
string — a login username.
The value domain is open: a username is account-scoped free text, so there is no closed set of sentinel values to test for. In particular there is no “not signed in” sentinel — an unauthenticated request gets an ordinary username back.
Behaviour
A public CloudPage request gets a value, not an empty result. An anonymous request to the published URL, carrying no Marketing Cloud session at all, rendered a username at HTTP 200. Empty() on the same value answered false and Length() gave 39.
The result is a value, not a page-terminating call. It compared against the empty string, rendered inline without a variable, and rendered unchanged nested inside a Concat between two surrounding characters. Every line after the call still rendered.
The value is stable inside one render. Three separate calls in the same request — an assignment, an inline call and a nested call — produced identical output.
The username is email-shaped, and unrelated to the employee ID
The value is not a bare login name. IndexOf found a single @ after a 16-character local part, a . earlier inside that local part, and no space anywhere; IsEmailAddress() accepted the whole value. Treat it as account-identifying data — it belongs in internal logic, not in rendered content.
It also carries no relationship to the numeric ID from AuthenticatedEmployeeID. Called in the same render, the two values compared as not equal, the ID was 9 characters against the username’s 39, and IndexOf of the ID inside the username answered 0 — its not-found result. Neither value can be derived from the other, so fetch whichever one you actually need.
Do not use it as an authentication check
Because a value always comes back, a page cannot infer from a non-empty result that its visitor is a signed-in Marketing Cloud user. Content gated on that check would be open to everyone. Use a real authentication mechanism for the gate and treat this function as context information only.
Show test script
%%[
VAR @b, @aeun, @sib
SET @b = RequestParameter("b")
/* known-good control: renders on every request, so a run of HTTP 422s
can be told apart from a deploy that failed to compile */
OutputLine(Concat("CTRL=[", Uppercase("ok"), "]"))
OutputLine(Concat("--- AEUN start ---"))
/* a plain anonymous request still produces a value */
SET @aeun = AuthenticatedEmployeeUserName()
OutputLine(Concat("AEUN=[", @aeun, "]"))
/* confirmed with a second function rather than read off empty brackets */
OutputLine(Concat("AEUN_EMPTY=[", IIf(Empty(@aeun), "empty", "not-empty"), "]"))
OutputLine(Concat("AEUN_LEN=[", Length(Concat(@aeun, "")), "]"))
/* the value is usable inline, nested and in a comparison */
OutputLine(Concat("AEUN_DIRECT=[", AuthenticatedEmployeeUserName(), "]"))
OutputLine(Concat("AEUN_IN_CONCAT=[", Concat("<", AuthenticatedEmployeeUserName(), ">"), "]"))
OutputLine(Concat("AEUN_CMP=[", IIf(@aeun == "", "eq-emptystring", "ne-emptystring"), "]"))
OutputLine(Concat("--- AEUN done ---"))
/* what the value looks like, and how it relates to the sibling ID */
IF @b == "shape" THEN
OutputLine(Concat("--- shape start ---"))
OutputLine(Concat("AT_POS=[", IndexOf(@aeun, "@"), "]"))
OutputLine(Concat("DOT_POS=[", IndexOf(@aeun, "."), "]"))
OutputLine(Concat("SPACE_POS=[", IndexOf(@aeun, " "), "]"))
OutputLine(Concat("IS_EMAIL=[", IIf(IsEmailAddress(@aeun), "yes", "no"), "]"))
SET @sib = AuthenticatedEmployeeID()
OutputLine(Concat("SIB_LEN=[", Length(Concat(@sib, "")), "]"))
OutputLine(Concat("SAME=[", IIf(@aeun == @sib, "identical", "different"), "]"))
OutputLine(Concat("ID_IN_NAME=[", IndexOf(@aeun, @sib), "]"))
OutputLine(Concat("--- shape done ---"))
ENDIF
/* argument counts the signature does not allow: each aborts its branch */
IF @b == "ar1" THEN
OutputLine(Concat("--- ar1 start ---"))
OutputLine(Concat("AEUN1=[", AuthenticatedEmployeeUserName("x"), "]"))
OutputLine(Concat("--- ar1 done ---"))
ENDIF
IF @b == "ar2" THEN
OutputLine(Concat("--- ar2 start ---"))
OutputLine(Concat("AEUN2=[", AuthenticatedEmployeeUserName("x", "y"), "]"))
OutputLine(Concat("--- ar2 done ---"))
ENDIF
]%%
Every marker and label in the test script goes through Concat(...), including single-argument ones. A bare string literal passed to OutputLine renders an empty line while the page still returns HTTP 200, so the marker silently vanishes.
Availability
| Platform | Available |
|---|---|
| Marketing Cloud Engagement | Yes |
| Marketing Cloud Next | No |
The official reference scopes this function to microsites using sender authenticated redirection and states it is not for CloudPages. That authenticated path was not exercised here — a public CloudPage cannot supply such a session — so everything on this page describes the unauthenticated CloudPage context only, and no claim is made about whose identity the returned username represents.