Admin: Salesforce Step-Up Authentication for Reports and Dashboards

Beginning June 10, 2026 Salesforce introduced mandatory identity verification challenges when users access reports and dashboards. This additional authentication layer helps protect sensitive organizational data even after users have already logged in with MFA.

What Is Step-Up Authentication?

Step-up authentication requires users to verify their identity again before accessing sensitive reporting data, even if they have already logged into Salesforce using MFA.

Supported verification methods include:

• Passkeys
• Security Keys (FIDO2)
• Salesforce Authenticator
• Authenticator applications (Google Authenticator, Microsoft Authenticator, etc.)
• Email or SMS verification (in certain scenarios)

When Users May Be Prompted

Users may be asked to verify their identity when performing any of the following actions:

• Opening the Reports tab
• Running a report
• Viewing a report
• Accessing dashboards
• Exporting report data

Verification requests occur based on a configurable cooldown period.

Cooldown Period

Organizations can configure how frequently users are prompted for additional verification:

• Minimum: 2 minutes
• Maximum: 120 minutes
• Salesforce default: 120 minutes

Impact on SSO Users

Even users who authenticate through identity providers such as Okta, Entra ID, Ping, Duo, or another SSO provider may still receive Salesforce step-up authentication challenges when accessing reports and dashboards. This verification is separate from the initial login process.

What Happens if Verification Cannot Be Completed?

Salesforce uses a fail-closed security model for report and dashboard access:

• If verification fails, report and dashboard access is blocked
• If no valid verification method is available, access remains blocked until resolved

Recommended Actions

Organizations should prepare for this change by taking the following steps:

• Review MFA enrollment across all users
• Move administrators and privileged users to one of the supported phishing-resistant authentication methods
• Validate SSO configurations and MFA claim mappings
• Ensure report and dashboard users have at least one registered Salesforce-supported verification method
• Test sandbox access and dashboard-heavy user experiences
• Communicate these upcoming changes to end users

What Users Should Expect

Users may notice occasional prompts to verify their identity when accessing reports or dashboards. These prompts are part of Salesforce's enhanced security framework and are separate from the normal login process.