Prepare for the upcoming Step-up Authentication requirements on Report Actions

Salesforce is strengthening its 'secure-by-default' architecture by implementing a new, mandatory time-based step-up Multi-factor Authentication (MFA) framework to enhance data protection against unauthorized data exfiltration. This control requires users to complete an additional step-up challenge when performing a sensitive action, such as accessing reports and dashboards, if a configurable amount of time has passed since their last step-up challenge.

For more info on the roadmap of upcoming targeted Security changes for the Salesforce Platform, see: Security-Related Product Updates to the Salesforce Platform.

What's Changing

Salesforce is implementing a new, mandatory time-based step-up authentication framework. Here are some of the key changes.

Reports & Dashboards Security: Salesforce applies the control to all reports and dashboards actions, including accessing/viewing, running, or exporting. Users will be challenged to perform a step-up MFA if a configurable time (for example, 2 hours) has passed since their last challenge. A new time-based Session Level Policy will be added for Reports and Dashboards called “Require periodic step-up authentication”.
Configurable Step-up Authentication Period: On the Identity Verification page, admins can configure the “Step-Up Authentication Period (Minutes)" field between 2 and 120 minutes, which adjust the re-authentication cadence .
Trigger Action: The step-up challenge is triggered when a user accesses, runs or views reports and dashboards, rather than waiting for them to click a "Download" or "Export" button. This broader criteria for additional verification helps to mitigate data theft via UI-based screen scraping or browser-based data capture.
MFA at Login vs. Step-up: Users must pass the step-up challenge even if they recently logged in with MFA.
Default-On Enforcement: The framework is enforced by default.
SSO User Handling: The framework is mandatory for all users, including those with Federated Single Sign-On (SSO). SSO users without Salesforce MFA registered are challenged via email or SMS OTP.
No Network Exemption: Step-up authentication for reports and dashboards actions is required even when the user is logged in to Salesforce on a trusted IP or corporate network.

Why Is Salesforce Making This Change

In response to evolving cybersecurity threats, we’re enhancing security and data protection. Reports and dashboard actions are considered a high-risk vector for data exfiltration. The step-up authentication framework provides these benefits.

Prevents Data Exfiltration: Step-up authentication is designed to preemptively slow or block potentially malicious data exfiltration.
Establishes High Assurance: Step-up authentication supports a new model of High Assurance. Reports and dashboards actions always require additional or stronger authentication challenges, even after a user has logged in with MFA.

When Does This Change Take Effect

Available in Sandboxes: Starting May 27, 2026, staggered over approximately 7 days
Available in Production: Starting May 27, 2026, staggered over approximately 15 days
Enforced in Sandboxes: Starting June 17, 2026, staggered over approximately 7 days
Enforced in Production: Starting July 1, 2026, staggered over approximately 30 days

Who's Affected

All Salesforce Users: This control is mandatory for all users accessing Salesforce reports, regardless of whether they use Direct Login or Federated Single Sign-On (SSO).
Salesforce Admins: This control applies to Salesforce admins who access reports. Also, admins can configure the re-authentication time window.

What to Expect

Step-up Challenge Prompt: Users will encounter an additional step-up authentication challenge when they attempt to run or view a report, provided the configurable Step-Up Authentication period has passed since their last challenge.
Supported Verification Methods: To complete the challenge, users can use any MFA verification method that Salesforce supports, including Passkeys, Security Keys, Salesforce Authenticator, or Time-based One-Time Password (TOTP) Apps.
Platform Users: Users without a registered MFA method will be challenged via a SMS One-Time Password (OTP) or email. Users without a reachable email address must register a Salesforce verification method, update their phone number, or provide a reachable email address.
Report Blocking: If the MFA service is unavailable or if the challenge fails, the report execution will be blocked to protect sensitive data.

To continue with the report action, users must successfully complete the step-up Multi-Factor Authentication (MFA) challenge presented to them.

Before Enforcement: How to Prepare

Review User Configuration: Review the new step-up authentication policy when available in June. On the Identity Verification page, under Session Security Level Policies, find Reports and Dashboards. To use the new policy, select “Require periodic step-up authentication”. For the Step-Up Authentication Period (Minutes) field, adjust the value within the Salesforce-defined threshold if needed.
Ensure Verification Methods: To ensure a smooth transition, confirm that all users, particularly those who use SSO, have configured at least one of these verification methods: a supported MFA verification method registered with Salesforce, a current email address, or an SMS mobile phone registered to their login. Users who can’t receive email or SMS must register a Salesforce verification method, update their phone number, or provide a reachable email address. In-app prompts for users without verification methods are available on a rolling basis starting in May 2026.

After Enforcement: Resolve Errors

If a user is blocked from viewing or running a report, take these remediation steps.

Failing the Step-up Authentication Challenge: Instruct the user to attempt the challenge again with a registered and supported MFA or identity verification method.
MFA Service Unavailability: The framework operates on a "Fail-Closed" security posture, blocking report execution if the MFA service is unavailable. If this occurs, contact Salesforce Customer Support.

Common Questions

Does logging in with MFA reset the step-up timer?

No. MFA at login doesn’t reset the timer for the step-up authentication on sensitive actions like sensitive Report Actions. Users are challenged again even if they recently logged in with MFA.

Which verification methods are supported for the step-up challenge?

All standard Salesforce MFA verification methods are supported, including Passkeys (biometrics and Security Keys), Salesforce Authenticator, and TOTP Apps. SSO users without a registered Salesforce MFA method are challenged via email or SMS One-Time Password (OTP).

Do Trusted IP Ranges or corporate networks grant an exemption?

No. Step-up authentication for sensitive Report Actions is required even when the user is logged in to Salesforce on a "trusted IP" or "corporate network."

Can an admin adjust the frequency of the challenge?

Yes. Admins can adjust the re-authentication cadence. However, they can’t set a value outside the valid range defined by Salesforce.

What happens if users have no MFA method enrolled and try to export a report?

If a user has no MFA method enrolled, Salesforce will send a one-time passcode (OTP) to the phone number or email address associated with their account. Since every Salesforce user is required to have an email on file, this serves as the fallback verification method.

To ensure a smooth experience:

Confirm the user's phone number and/or email address is valid and accessible
If the OTP email isn't received, ask the user to verify their phone number and/or email address in their profile
For a more reliable experience going forward, users should register an MFA verifier in Salesforce (such as an authenticator app, security key, or built-in authenticator) . Note for SSO users: SSO-authenticated users may not have an MFA verifier registered directly in Salesforce, making the email OTP fallback especially relevant for this group.

Can the step-up challenge be fulfilled by the SSO IdP, or must it always be a Salesforce-native method?

Step-up authentication must be completed using a Salesforce-native verifier, it cannot be delegated to an external SSO identity provider (IdP). Even if a user authenticates into Salesforce via SSO, they are still required to satisfy the step-up challenge using one of the following:

A Salesforce-registered MFA method (such as Salesforce Authenticator, a TOTP authenticator app, a security key, or a built-in authenticator like Face ID or Touch ID)
A one-time passcode (OTP) delivered via email or SMS to the contact information associated with their account

This means SSO users who do not have a Salesforce-native verifier registered will fall back to email or SMS OTP to complete the step-up challenge.

Are scheduled or subscribed reports affected by step-up authentication? *

Automated report delivery, whether scheduled or subscribed, is not affected by step-up authentication. Since these run in a background context with no active user session, the step-up challenge is bypassed entirely.

However, if a user clicks the link in a subscription notification email to open the report directly in Salesforce, step-up authentication will be triggered at that point, since the user is now interacting with the report in an active session.

Are embedded reports and dashboards affected by step-up authentication?

Embedded reports and dashboards, such as those placed in a Lightning App Builder page, are not subject to step-up authentication. These components are exempted from the step-up session-level policy check, so users will not be prompted for a step-up challenge when viewing embedded content in Lightning pages.

Does step-up authentication apply to Experience Cloud or Partner Community users? *

External Experience Cloud users (customers, partners, and community members accessing Salesforce through an Experience Cloud site) are fully exempt from step-up authentication. Step-up will not be triggered for these sessions.
Internal Salesforce users (employees) logging into an Experience Cloud site are not exempt. If an internal user attempts to access a report through an Experience Cloud site, they will be blocked. Internal users who need to access reports should do so through their internal Salesforce org, where they can complete the step-up challenge normally.

Does step-up authentication apply when an administrator uses "Login As" to access a user's account? *

No. When an administrator uses the "Login As" feature to access Salesforce as another user, step-up authentication is not triggered. "Login As" sessions are fully exempted from the step-up requirement.

Does step-up authentication apply to API access to reports and dashboards?

No. Step-up authentication does not apply to non-interactive API sessions. All API-based access to reports and dashboards (including integrations, connected apps, and programmatic data retrieval) is fully exempt from the step-up requirement. Only interactive UI sessions trigger the step-up challenge.

Does step-up apply when running SOQL queries in Developer Console or Workbench? *

No. SOQL queries executed in Developer Console and Workbench are exempt from step-up authentication.

Does step-up authentication apply to Salesforce Mobile App users accessing reports and dashboards? *

No. Users accessing reports and dashboards via the Salesforce Mobile App are exempt from step-up authentication. The step-up challenge will not be triggered for mobile sessions.

Does step-up authentication apply to Developer Edition, trial, scratch, or other non-paid orgs? *

No. Step-up authentication enforcement is scoped to paid Production and Sandbox orgs only. Developer Edition orgs, trial orgs, scratch orgs, and other non-paid org types are not subject to enforcement.

* Note: Bugs have been reported for this behavior and fixes are targeted for patch releases in Summer '26.

Change Log

Date	Change
June 4, 2026	Clarified Experience Cloud exemption: external users are exempt; internal/employee users accessing reports via an Experience Cloud site are not exempt and will be blocked. Added new FAQs: API access (non-interactive), paid orgs only scoping, SOQL in Developer Console/Workbench, and Salesforce Mobile App are all exempt from step-up authentication.
June 2, 2026	Updated enforcement dates for Sandboxes and Production. Clarified that Step-up Authentication applies to in-app access of reports and dashboards, not just Report Export activity. Renamed Session Level Policy settings: "cool-down" terminology removed. New settings are "Require periodic step-up authentication" and "Step-Up Authentication Period (Minutes)." Added new FAQs.
May 5, 2026	Initial publication