Salesforce is preparing to enable Step Up Authentication for Report Actions. Right now, this feature breaks so many things with the Reports and Dashboards that we are putting together an article with the issues and recommendations. Not just for Report Sender, but for all the ways you use Reports and Dashboards in your org.
Updates
June 2nd, 2026: Thanks to everyone reporting issues with this, Salesforce has delayed enforcement.
Previous enforcement dates:
Sandboxes: Starting June 3, 2026
Production: Starting June 10, 2026
New enforcement dates:
Sandboxes: Starting June 22, 2026
Production: Starting July 13, 2026
How to Test
If you want to see how this change affects your organization, here's how to test.
Currently, we have only found this feature in sandboxes on the Preview servers. To check which server your sandbox is on, go to your production org. Then go to Setup, Sandboxes. Under the Release Type column, see if any say "Preview."
Go to Setup, Identity Verification
Under Session Security Level Policies, change Reports and Dashboards to “Require periodic step-up authentication.”
At the bottom, you can set the period (default is 120 minutes)
It will only let you enter between 1 and 120
Save your changes
Make sure MFA is set as a high assurance setting
Go to Setup, Session Settings
Make sure your preferred MFA method is in the right column
Known Issues
The reporting API returns a 403 error: high assurance session required.
Report Sender gets the dashboard export via browser emulation, and it will no longer work. The dashboard API endpoint is only available to companies with CRM Analytics licenses, which currently fails due to issue #1.
Embedded dashboards on the home page or other lightning pages throw a JavaScript error unless the user has recently completed the step-up authentication from the Reports or Dashboards tab. See Known Issue
Reports & Dashboards disappear from the mobile app. See Known Issue
Standard Salesforce Reports & Dashboards subscriptions deliver an email with an error. See Known Issue
Users must complete MFA validation when they go to the Reports or Dashboards tab, even if they've just validated MFA at login seconds ago. Salesforce considers this working as expected.
If you use Lightning Experience Sites, then users can't see any reports or dashboards, just a JavaScript error.
If you use a Visualforce Site, then users now see a message that Classic Reports & Dashboards will expire on March 31, 2027.
Recommended Actions
Test these changes in a preview sandbox.
Log a case with Salesforce to request an extension on the enforcement of this feature.
Recommended Case Details:
Subject: Issues with Step Up Authentication for Report Actions
We request that you do not enforce Step Up Authentication for Report Actions in our org. If you force us to have it, we ask that you delay enforcement for as long as possible.
We do not find that it increases the security of our org. If someone has access to a Salesforce session, they can already run SOQL queries and export any data their permissions allow.
We have also tested the feature in our sandbox and have found the following issues:
It breaks an app that we rely on to distribute reports to our customers and partners: CloudAnswers Report Sender.
[Fill out with other issues that affect your org. See the list above for issues that have already been identified.]