Salesforce is preparing to enable Step Up Authentication for Report Actions. When initially released to sandboxes, this change broke most of the ways reports and dashboards are used. Salesforce has fixed all known issues and plans to begin enforcing this in production starting July 1st, 2026.
Updates
June 19th, 2026: Version 3.31 is available for testing in sandboxes. Production release scheduled for June 26th.
June 16th, 2026: New version of Report Sender that works with Step Up Authentication is in final testing and will be rolling out to sandboxes this week. If your sandbox receives step-up authentication enforcement before the upgrade, Report Sender will not work. If this affects your testing, please let us know.
June 15th, 2026: Several known issues with Salesforce functionality have been marked as fixed. We are testing a new version of Report Sender that works with the step-up settings.
June 2nd, 2026: Thanks to everyone reporting issues with this, Salesforce has delayed enforcement.
Previous enforcement dates:
Sandboxes: Starting June 3, 2026
Production: Starting June 10, 2026
New enforcement dates:
Sandboxes: Starting June 17, 2026
Production: Starting July 1, 2026
How to Test
If you want to see how this change affects your organization, here's how to test.
Go to Setup, Identity Verification
Under Session Security Level Policies, change Reports and Dashboards to “Require periodic step-up authentication.”
At the bottom, you can set the period (default is 120 minutes)
It will only let you enter between 1 and 120
Save your changes
Make sure MFA is set as a high assurance setting
Go to Setup, Session Settings
Make sure your preferred MFA method is in the right column
Known Issues
[Fixed] The reporting API returns a 403 error: high assurance session required.
[Fixed] Embedded dashboards on the home page or other lightning pages throw a JavaScript error unless the user has recently completed the step-up authentication from the Reports or Dashboards tab. See Known Issue
[Fixed] Reports & Dashboards disappear from the mobile app. See Known Issue
[Fixed] Standard Salesforce Reports & Dashboards subscriptions deliver an email with an error. See Known Issue
[Fixed] If you use Lightning Experience Sites, then users can't see any reports or dashboards, just a JavaScript error.
Users must complete MFA validation when they navigate to the Reports or Dashboards tab, even if they've just validated MFA at login. Salesforce considers this as working as expected.