---
schema_version: "1"
id: 27d1568c0075f17dc980ea59fda8fbdd2ad66e430f2c62973279576b2f8b4b6f
title: Test Step-Up Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_test_step-up-auth.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_test_step-up-auth.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c00caf8ab8da9ae5eaa15df0705bb7e377500cd879977f2ae06e3e333e2bbf50
description: To prepare for upcoming security requirements, you can now enable step-up authentication for different setup areas in your org. With step-up authentication, Salesforce prompts users for periodic authentication to take certain actions. To control how often users are prompted, configure the step-up authentication period. The maximum period is 2 hours.
products:
  - Cross Cloud
release: "262"
---
# Test Step-Up Authentication

To prepare for upcoming security requirements, you can now enable step-up authentication for different setup areas in your org. With step-up authentication, Salesforce prompts users for periodic authentication to take certain actions. To control how often users are prompted, configure the step-up authentication period. The maximum period is 2 hours.

**Where:** This change applies to Lightning Experience and Salesforce Classic in all editions.

**When:** To understand when the step-up authentication requirement is enforced, see [Prepare for the upcoming Step-up Authentication requirements on Report Actions](https://help.salesforce.com/s/articleView?id=005321566&type=1&language=en_US).

The "Require periodic step-up authentication" setting is available for testing starting on May 27, 2026.

These changes are available on a rolling basis starting June 15, 2026.

- A new setting for Reports and Dashboards, "Require periodic step-up authentication when exporting" is available for testing.
- When step-up authentication is enabled, it's required regardless of high-assurance settings in Session Settings. Previously, step-up authentication worked only if the Session Security Level for MFA was set to high-assurance. [Learn more about session security levels.](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US)
- Duplicate settings on the Access Policies page are hidden when step-up authentication is enabled. A link points you to the Identity Verification page to manage these settings.

These exemptions are available on a rolling basis starting on June 29, 2026.

- Step-up authentication isn't required when the user’s [profile has Login IP restrictions](https://help.salesforce.com/s/articleView?id=xcloud.login_ip_ranges.htm&type=5&language=en_US) configured and the IP address has not changed between login and report download. Range limits are already enforced for this configuration.
- Step-up authentication isn't required when the user’s [profile has Login IP restrictions](https://help.salesforce.com/s/articleView?id=xcloud.login_ip_ranges.htm&type=5&language=en_US) configured and Enforce login IP ranges on every request is enabled in Session Settings for the org.

**How:** From Setup, in the Quick Find box, enter Identity, and then select **Identity Verification**. In the Session Security section, find the setup area and select **Require periodic step-up authentication**.

For Reports and Dashboards only, you have the option to select **Require periodic step-up authentication when exporting**. With this option, users can view reports without being challenged for step-up authentication, in contrast to the behavior when **Require periodic step-up authentication** is enabled.

For the Step-Up Authentication Period, enter a value from 1 to 120 minutes. The default value is 120.

While a user is interacting with the setup area (for example, viewing or exporting a report), Salesforce periodically prompts them for reauthentication.

To complete step-up authentication, users can use these methods:

- Salesforce multi-factor authentication (MFA) method, such as a passkey (built-in authenticator or security key) or an authenticator app.
- Email or phone number-users who don’t have a registered MFA method, such as single sign-on (SSO) users, can get a one-time password sent to them. Salesforce doesn’t require the email address or phone number to be verified.

#### See Also

- [_Knowledge Article_: Prepare for the Upcoming Step-up Authentication Requirements on Report Actions](https://help.salesforce.com/s/articleView?id=005321566&type=1&language=en_US)