Loading

Prepare for Transaction Security Policy Enhancements

Udgivelsesdato: May 5, 2026
Beskrivelse

To provide enhanced baseline protection against data exfiltration, Salesforce is rolling out a default Transaction Security Policy (TSP) on ReportEvent for all eligible Salesforce Shield and/or Event Monitoring (EM) customers. For more info on the roadmap of upcoming targeted Security changes for the Salesforce Platform, see: Security-Related Product Updates to the Salesforce Platform.

What’s Changing

  • TSP Management Permission: Salesforce is introducing a new Modify Transaction Security Policy user permission. To create, update, delete, enable, or disable TSPs, both the Modify Transaction Security Policy and Customize Application permissions are required. Create, update, delete, enable, and disable operations on TSPs via UI will also require step-up authentication.

  • Default ReportEvent TSP: Salesforce is introducing and enabling a default TSP for report exports initiated through the UI. This policy is triggered when an export exceeds 10,000 records. Such report export activities will also require step-up authentication.

Why Is Salesforce Making This Change

Large report exports are a common vector for malicious or unintended data exfiltration. This change upgrades protection via Event Monitoring to actively prevent malicious or unintended data exfiltration through TSP controls.

When Does This Change Take Effect

Availability of new Permission and default TSP

  • Sandboxes: Starting June 1, 2026
  • Production: Starting June 15, 2026

Enforcement of new Permission and default TSP

  • Sandboxes: Starting June 22, 2026
  • Production: Starting July 13, 2026

Who’s Affected

  • All Event Monitoring (EM) customers, including those with Salesforce Shield or standalone EM licenses, in both sandbox and production orgs.

  • Users who create, update, or delete, enable or disable TSPs.  

  • Users who perform report exports that exceed 10,000 records via the Salesforce UI.

What to Expect

  • For TSP Management: Only users with both the Customize Application and the new Modify Transaction Security Policy permissions will be able to perform create, update, delete, enable, and disable operations on TSPs. Read-only access will be granted to all other users having only the Customize Application permission. Successful re-authentication via step-up authentication is required each time any TSP is created, updated, deleted, enabled, or disabled via UI.

  • For Report Exports: When a report export via UI exceeds 10,000 records the default TSP will be triggered which will require the user to complete a step-up authentication.

Løsning

Before Enforcement: How to Prepare

After Salesforce deploys the changes in your org:

  • Review your current users who manage TSPs. To allow them to continue to create, update, or delete, enable or disable TSPs, assign them the new Modify Transaction Security Policy permission and ensure that they have step-up authentication configured.

  • Review the default disabled TSP in a sandbox. Test this policy to ensure it aligns with your security use cases. You can then choose to enable or modify it. 

Note: The policy will remain fully editable even after automatic enforcement.

After Enforcement: Resolve Errors

  • For TSP Permission management : 

    • Permission Check: Ensure that the user has been assigned the new Modify Transaction Security Policy permission, in addition to the Customize Application permission

    • Authentication Check: If a create, update, delete, enable, and disable action is blocked, ask the user whether they were prompted to re-authenticate. That step-up authentication is required to complete the operation.

  • For Report Exports: If step-up authentication isn’t configured for a user when the default ReportEvent policy is triggered, the report export will be blocked. The user is prompted to set up step-up authentication before the export can be completed.

Common Questions

What if I already have a ReportEvent policy?

The default policy will be deployed as a new, disabled, separate policy and will not impact any existing Transaction Security Policies, whether active or disabled. You can review, edit, or disable the default ReportEvent policy. Salesforce will not automatically enable the default policy if another ReportEvent policy already exists in the org.

What if I am still testing the default policy by enforcement date?

If you have edited the default policy in any form, Salesforce will assume you are reviewing the policy hence it won’t auto enable.



Change Log

Date

Change

May 5, 2026

Initial publication

 

 

Yderligere ressourcer

Additional Resources

ReportEvent

Vidensartikelnummer

005321565

 
Indlæser
Salesforce Help | Article