To prepare for upcoming security requirements, you can now enable step-up authentication for different setup areas in your org. With step-up authentication, Salesforce prompts users for periodic authentication to take certain actions. To control how often users are prompted, configure the step-up authentication period. The maximum period is 2 hours.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
When: To understand when the step-up authentication requirement is enforced, see Prepare for the upcoming Step-up Authentication requirements on Report Actions.
The "Require periodic step-up authentication" setting is available for testing starting on May 27, 2026.
These changes are available on a rolling basis starting June 15, 2026.
- A new setting for Reports and Dashboards, "Require periodic step-up authentication when exporting" is available for testing.
- When step-up authentication is enabled, it's required regardless of high-assurance settings in Session Settings. Previously, step-up authentication worked only if the Session Security Level for MFA was set to high-assurance. Learn more about session security levels.
- Duplicate settings on the Access Policies page are hidden when step-up authentication is enabled. A link points you to the Identity Verification page to manage these settings.
These exemptions are available on a rolling basis starting on June 29, 2026.
- Step-up authentication isn't required when the user’s profile has Login IP restrictions configured and the IP address has not changed between login and report download. Range limits are already enforced for this configuration.
- Step-up authentication isn't required when the user’s profile has Login IP restrictions configured and Enforce login IP ranges on every request is enabled in Session Settings for the org.
How: From Setup, in the Quick Find box, enter Identity, and then select Identity Verification. In the Session Security section, find the setup area and select Require periodic step-up authentication.
For Reports and Dashboards only, you have the option to select Require periodic step-up authentication when exporting. With this option, users can view reports without being challenged for step-up authentication, in contrast to the behavior when Require periodic step-up authentication is enabled.
For the Step-Up Authentication Period, enter a value from 1 to 120 minutes. The default value is 120.
While a user is interacting with the setup area (for example, viewing or exporting a report), Salesforce periodically prompts them for reauthentication.
To complete step-up authentication, users can use these methods:
- Salesforce multi-factor authentication (MFA) method, such as a passkey (built-in authenticator or security key) or an authenticator app.
- Email or phone number-users who don’t have a registered MFA method, such as single sign-on (SSO) users, can get a one-time password sent to them. Salesforce doesn’t require the email address or phone number to be verified.