Engagement-Marketing Cloud Connect with Salesforce Platform Security Enhancements

The Salesforce Platform has had multiple security enhancements that impact how Marketing Cloud Connector interacts with it.  Below are a list of the enhancements that will impact MCC, along with the impact and current resolution. 

Salesforce Platform Enhancements

Phishing-Resistant MFA Enforcement for Privileged Users, Including Admins

• Sandboxes: Starting June 22, 2026, staggered over approximately 7 days

• Production: Starting July 1, 2026, staggered over approximately 30 days

Impact:  
Users with System Administrator profile, Modify All Data, View All Data, Customize Application, or Author Apex permissions will be required to have Phishing-Resistant MFA.  This will require the SF System User for the integration to have Phishing-Resistant MFA setup.  This requirement can make it difficult for users to login as the SF System User if they do not have the MFA. 

Resolution: 

• Another Administrator can generate a temporary verification code that can be used when prompted for MFA.  Generate a Temporary Verification Code

• Use the Login User feature that will allow Administrators to login as an user.  Control Login Access Policies 

MFA Enforcement for All Employee Users

• Sandboxes: June 22, 2026 (staggered over approximately 7 days).

• Production: July 20, 2026 staggered over approximately 30 days.

Impact:  
Any users who do not have the System Administrator profile, Modify All Data, View All Data, Customize Application, or Author Apex.  This requirement can make it difficult even if the SF System User uses a Custom Profile. 

Resolution: 

• Another Administrator can generate a temporary verification code that can be used when prompted for MFA.  Generate a Temporary Verification Code

• Use the Login User feature that will allow Administrators to login as an user.  Control Login Access Policies 

Step-up Auth for Report Activities (Time Based Session Level Policy)

• Enforced in Sandboxes: Starting June 17, 2026, staggered over approximately 7 days

• Enforced in Production: Starting July 1, 2026, staggered over approximately 30 days

Impact:  
All Salesforce accounts are requiring step-up authentication when Reports are being exported. When creating an import activity with step-up authentication on, the report search will freeze with the white screen or encounter error "A communication error has occurred with Salesforce.”

Resolution: 

• When actions are taken engage that Marketing Cloud Connect package, the step-up authentication is bypassed. All other actions will follow the step-up authentication process.

• Known Issue

Transaction Security Policy Enhancements

• Enforced in Sandboxes: Starting June 22, 2026

• Enforced in Production: Starting July 13, 2026

Impact:  
A default Transaction Security Policy is being enabled on ReportEvent for all eligible Salesforce Shield and/or Event Monitoring (EM) customers. For MCC customers, when a Salesforce report is imported or sent to via MCC if the report exceeds 10,000 record step-up authentication will be required. These accounts will not bypass the Step-Authentication.

Report Event Policies 

Resolution: 

• Disable the TSP associated with ReportEvent
                    OR

• Increase the number of records that can be imported prior to the TSP being triggered. 

  • Setup > Quick Find > Transaction Security 

  • Select Transaction Security Policies 

  • Select the appropriate policy > Edit 

  • Update the Condition: “Rows Processed Greater than” to something over 10,000 records

• To apply either resolution the user will need to have the new Modify Transaction Security Permission as well as the Customize Application Permission

• Knowledge Article