Salesforce has rolled out another security change, and this one may catch your users off guard mid-workflow. As of July 27, 2026 for production orgs (and July 6, 2026 for sandboxes), Salesforce will begin requiring additional authentication when exporting reports. Salesforce behind the scenes attempts to detect behavior that looks different from that user's normal activity. If detected, it will interrupt the action and require the user to re-verify their identity with Multi-Factor Authentication before the data can be exported. Salesforce calls this "step-up authentication."

For full details, please refer to the official Help.Salesforce.com article.

What is Changing

Report exports and large data queries are one of the most common ways data walks out the door when an account becomes compromised. Rather than restricting exports for everyone, Salesforce is taking a targeted approach: normal report activity is untouched, but anomalous report activity triggers an MFA challenge before the export completes.

A few things worth knowing about how this behaves:

• The challenge is dynamic, not scheduled. There is no setting to configure and no permission to assign. Salesforce's model decides in near real time.
• The challenge can fire even if the user recently completed MFA, including at login. Step-up is a separate verification event.
• Salesforce is rolling this out gradually, beginning in a report-only mode before full enforcement actions turn on. You may not see challenges on day one.
• The current scope is UI-based report downloads. Other export paths are not included at this time.

Who is Affected

All Salesforce users who access and export reports in sandbox and production orgs are in scope.

External Experience Cloud users are fully exempt. If your customers, partners, volunteers, or community members access Salesforce through an Experience Cloud site, step-up authentication will not be triggered.

Important: Only Standard MFA is Required, Even for Admins

This is the piece we want to be very clear about, because it is easy to assume otherwise after the phishing-resistant MFA enforcement that hit admins on July 1.

Step-up authentication only requires a standard MFA method. The stricter phishing-resistant requirement does not apply here, and it does not apply to administrators either. An admin who was required to register a passkey or hardware key for login can still satisfy a step-up report export challenge with the Salesforce Authenticator app or a TOTP code.

In practice this means your users do not need to register anything new. Whatever they are already enrolled in, standard or phishing-resistant, will work to clear the challenge. Users can also verify with a registered email address or SMS phone number on their user record if no verifier is registered.

The one group that will have a problem is users with no registered MFA verifier and no valid email address or phone number on their user record. Those users will be blocked from completing the export with no way to proceed.

Important: Single Sign-On Will Not Satisfy the Challenge

If your organization logs into Salesforce through an SSO provider such as Okta, Google Workspace, or Microsoft Entra ID, please read this section carefully.

At this time, Single Sign-On does not satisfy the step-up authentication challenge. Even if your identity provider enforces MFA at login, and even if it passes the AMR/ACR values that satisfy the phishing-resistant login requirement, that authentication will not clear a step-up report export challenge. Salesforce is looking for a verification method it controls directly.

Here is the part that trips people up most: there is no way to make Salesforce hand the challenge off to your identity provider. When a user signs in through SSO, your IdP verifies them once and passes Salesforce an assertion. That is a login-time handoff, and it is finished. The step-up challenge fires later in the session, and Salesforce resolves it entirely against verification methods registered inside Salesforce. It does not redirect back out to Okta or Entra to have them re-challenge the user.

The practical consequence is that this is not a problem you can solve in your identity provider. There is no Okta policy or Entra Conditional Access rule that will satisfy a Salesforce step-up prompt, no matter how strict you make it. Your users need a Salesforce-side method.

That means SSO users need a Salesforce-side verification method available to them, or they will be stopped when a challenge fires. That can be any of the following:

• A supported MFA verification method registered with Salesforce (Salesforce Authenticator, a third-party authenticator app, TOTP, built-in authenticator, security key, or passkey)
• A current, valid email address on their user record
• An SMS-capable mobile phone number registered to their login

This is worth auditing as soon as possible. SSO-provisioned users are the most likely group in your org to be missing all three, because they likely were never sent a Salesforce welcome email and never registered a Salesforce verifier.

Troubleshooting: "Problem Verifying Your Identity"

If a user completes the verification prompt and still gets stopped with a "Problem verifying your identity" error, the issue is usually that Salesforce is not treating their verification method as strong enough to raise the session to High Assurance.

To check:

1. Go to Setup → Session Settings → Session Security Levels.
2. If your users log in through SSO, confirm your SSO login method is listed in the High Assurance column.
3. If your users log in natively with a username and password, confirm Multi-Factor Authentication is listed in the High Assurance column.

If the method is sitting in Standard instead of High Assurance, move it over and have the user try the export again.

To be clear on how this relates to the section above: Session Security Levels controls how Salesforce rates the session your login established. That is a separate question from what clears the step-up challenge itself. Setting your SSO method to High Assurance does not mean SSO can satisfy a step-up prompt, and your users still need a Salesforce-side verification method registered.

What You Should Do

1. Audit your user records. Run a report on active users and check for blank Email and Mobile fields. Fill in the gaps.
2. Pay special attention to SSO users. As covered above, this is where the exposure is. Confirm every SSO user has at least one Salesforce-side verification method available.
3. Check shared, kiosk, and service accounts. Any account not tied to a specific person with a real inbox or phone is a candidate to get stuck.
4. Give your team a heads up. Most users will never see this. The ones who do will see it unexpectedly, in the middle of a task they have done a hundred times before. A short note explaining that an occasional verification prompt on a report export is expected behavior, and not a sign that something is broken, will save you a round of support tickets.
5. Test in a sandbox. Sandboxes have been enforcing since July 6, so you can validate your users' experience there.

Take Action Now

Production enforcement began July 27, 2026. Because the rollout is gradual and the challenges are triggered by behavior rather than a schedule, you will not get advance warning before a specific user gets prompted. The users most likely to trip the model are the ones pulling large or unusual exports, although any user exporting a report can be required to complete the step-up challenge.

The good news is that preparation is simple. If your users have MFA registered or a verified email or phone on file, they will be able to clear the challenge in a few seconds and move on.

If you have questions about these changes, want help auditing your users, or are unsure how this interacts with your SSO configuration, please reach out to Prolocity. We are happy to walk through it with you.