Salesforce has begun enforcing Step-Up Authentication for Report Actions. When initially released to sandboxes, this change broke most of the ways reports and dashboards are used. Salesforce has fixed all known issues and plans to begin enforcing this in production starting July 1st, 2026.
Known Issues
IP Restrictions: IP restrictions on a user's profile can prevent Heroku from accessing the reporting API.
Suggested fix: Relax IP Restrictions for the connected app or remove the IP restrictions from the user.
Lock Sessions to the originating IP: Since our app may call the reporting API from Apex or Heroku, we currently require this setting to be disabled.
Suggested fix: Disable this from Session Settings
User does not have access to User External Credentials. To make a secure callout, users need permission to access our credentials, and we can't add this to our permission sets.
Suggested fix: Enable access to User External Credentials.
Reporting API Limitations
The following issues are all related to switching from the previous export endpoints to the reporting API. Once step-up authentication is enabled for report actions in your org, we have to use the reporting API.
Long text area fields are being truncated to 255 characters in CSV and XLS formats.
Reports grouped by date and sent as details only (CSV or XLS) will not be sorted by date. The workaround is to remove the grouping and sort by date if you're sending the report in any format besides XLSX Formatted.
Currency fields are exported in English locale instead of the user's locale. Fix is in testing and will be released soon.
Reports with over 100 columns fail.
Checkboxes always show true/false as values. Previously, for CSV and XLS formats, checkboxes showed 0/1.
Details only XLSX may have a header, report filters, and total rows. We already handle this for most XLSX Details reports, but some reports come in a different format, and the extra information isn't being stripped.
Reports may get "Job stalled more than allowable limit". This error means that it took too long to generate the report. We've already increased the limit beyond the two-minute timeout we had previously, but large reports can still time out. Reports using XLSX Details format take even longer than the other formats. We recommend looking at the Read timed out article for more tips on optimizing reports.
Workaround
If Salesforce has not enforced step-up authentication in your org, you can log a case with Salesforce to request an extension while we work on custom code to fix these shortcomings. You would also need to disable this setting if you enabled it in advance. See the "How to Test" section below to see how it would've been enabled. After disabling, please contact support and let us know you want us to revert your org to use the original export endpoints.
Updates
July 19th, 2026: Due to numerous discrepancies in the reporting API, we will update the code to first try the export URLs, then fall back to the reporting API if we encounter a verification page. So if you have not manually enabled step-up authentication and Salesforce has not enforced it in your org, then you will see the old file formats. If any of the reporting API limitations above affect your business, you may want to log a case with Salesforce to request an extension.
July 18th, 2026: Version 3.36 is now available, which reduces callout time limits and invalid session ID errors.
June 30th, 2026: In preparation for step-up authentication to be enforced sometime in July, all orgs have been updated to use only the reporting API for file generation. There may be minor differences in the files from the export URLs. If any of them cause issues, please contact our support team.
June 26th, 2026: Version 3.33 has been released to all orgs. This includes a few fixes we found in sandboxes. Production orgs will have step-up authentication changes enabled from June 26th to July 1st through a rolling enablement period.
June 19th, 2026: Version 3.31 is available for testing in sandboxes. Production release scheduled for June 26th.
June 16th, 2026: New version of Report Sender that works with Step Up Authentication is in final testing and will be rolling out to sandboxes this week. If your sandbox receives step-up authentication enforcement before the upgrade, Report Sender will not work. If this affects your testing, please let us know.
June 15th, 2026: Several known issues with Salesforce functionality have been marked as fixed. We are testing a new version of Report Sender that works with the step-up settings.
June 2nd, 2026: Thanks to everyone reporting issues with this, Salesforce has delayed enforcement.
Previous enforcement dates:
Sandboxes: Starting June 3, 2026
Production: Starting June 10, 2026
New enforcement dates:
Sandboxes: Starting June 17, 2026
Production: Starting July 1, 2026
How to Check Your Settings and Test
If you want to see if this has been enabled or test how this change affects your organization, here are the instructions.
Go to Setup, then Identity Verification.
Under Session Security Level Policies, view Reports and Dashboards. If Salesforce has enforced this setting in your org, you will only have three options here, and all of them either require step-up authentication or prevent people from using it altogether. If your org still has more than three options, then it's still up to your administrators which setting you set. To test Report Sender with this setting enabled, change it to “Require periodic step-up authentication.”
At the bottom, you can set the period (default is 120 minutes)
It will only let you enter between 1 and 120
If you change this setting, save your changes
To make sure MFA works, you may also want to check that MFA is set up properly. MFA should be set as a high assurance setting:
Go to Setup, Session Settings
Make sure any of your allowed MFA methods are in the right column