Prepare for Salesforce Step-up Authentication in Anomalous Report Export

This section explains how to prepare for the Salesforce step-up authentication requirement for anomalous report activity, who is affected, when it takes effect, and how to resolve failed challenges.

Watch: Video Resource

To get an overview of the Step-up Authentication requirement, watch the video below or open it in a new tab: Salesforce Step-Up Authentication

Why Is Salesforce Making This Change

Report exports and large data queries are primary vectors for unauthorized data exfiltration. By leveraging machine learning to detect behavioral anomalies in near real-time, Salesforce can block potentially malicious exfiltration attempts by unauthorized actors before the data leaves the org.

When Does This Change Take Effect

• Sandboxes: Starting July 6, 2026
• Production: Starting July 27, 2026

Note: Salesforce rolls this change out via a gradual activation plan, starting with a report-only mode before full auto-containment actions.

Who Is Affected

• All Salesforce users who access reports in sandbox and production orgs.
• External Experience Cloud users (customers, partners, and community members accessing Salesforce through an Experience Cloud site) are fully exempt from step-up authentication. Step-up is not triggered for these sessions.

What to Expect

Most users experience no change to their daily workflow. However, if Salesforce detects anomalous behavior, the user sees these changes:

• UI Sessions: The user is challenged with a Step-up MFA challenge on their next sensitive action (for example, a report export), even if they recently performed Step-up MFA.

Note: If the user has not registered a Salesforce MFA verifier and lacks a valid email address or phone number, the user cannot complete the Step-up MFA challenge on their next sensitive action (for example, a report export) and is blocked from proceeding.

Before Enforcement: How to Prepare

• Review User Configuration: To ensure a smooth transition, confirm that all users, particularly those who use Single Sign-on (SSO), have configured at least one of these verification methods: a supported MFA verification method registered with Salesforce, a current email address, or SMS mobile phone registered to their login.

After Enforcement: Resolve Errors

• Failed Step-up Challenges: If a user can't complete the Step-Up challenge, the user is denied access to the sensitive operation. Ensure that users have access to their MFA verification methods, registered email, or SMS phone number.

Common Questions

Is this a mandatory feature?

The control is mandatory for all users accessing Salesforce reports in sandbox and production orgs.

Does this new model cover all data exfiltration activities?

The current focus for the model is on UI-related report downloads.

Change Log