In a standrd setup these users would need to be WebAdmins http://webhelp.episerver.com/latest/commerce/access-rights.htm 

However you must also make sure you web.config is correctly setup such as

        <add name="CmsEditors" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="WebEditors" mode="Any" />
        <add name="CmsAdmins" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="WebAdmins" mode="Any" />
        <add name="Creator" type="EPiServer.Security.CreatorRole, EPiServer" />
        <add name="PackagingAdmins" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="WebAdmins, Administrators, REDWEB\PMT" mode="Any" />
        <add name="CommerceAdmins" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="WebAdmins, Administrators" mode="Any" />

You can adjust these group if needs me (such as if they are coming from an OWIN SSO solution by changing these groups in your configs)

Yes, and that is ok. But our customer wants to give access to the marketing tab also for WebEditors. In the latest Commerce there are a group called MarketingManager, is that included in 11.8?

I'm just having a look, have you tried add this MappedRole in and setting the roles to WebEditors? This might make it work if it's just that the Web.config doesn't have the mapped role set up

This was added in 9.19.0 from the look of class docs, and it's in here https://world.episerver.com/documentation/developer-guides/commerce/security/Authorization-and-authentication/ so I'd say to make sure as above it's in the config

<add name="MarketingManagers" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="WebEditors" mode="Any" />