Step up Auth for exporting reports

Note Salesforce updates are subject to change beyond our control. Sage People attempts to maintain our content in alignment: for the most up to date information, refer to Salesforce documentation.

What's happening?

Salesforce are requiring additional verification before you're able to export reports. Users that use MFA within Sage People will be required to re-verify. Users that login via SSO or don't use MFA for direct logins, a one-time password is sent via email or text.

When is this happening?

  • Available in Sandboxes: Starting May 27, 2026, staggered over approximately 7 days

  • Available in Production: Starting May 27, 2026, staggered over approximately 15 days

  • Enforced in Sandboxes: Starting June 3, 2026, staggered over approximately 7 days

  • Enforced in Production: Starting June 10, 2026, staggered over approximately 20 days

Will this affect you?

This change will affect any users that export reports.

Recommended action

Inform any users that export reports that they’ll need to complete this security step.

For more information, see the Salesforce article Prepare for step-up authentication requirements.

Known issues from Salesforce

Details Only Export in Report for csv format is redirecting to classic mode

Report Doesn't Export With Applied Filters

FAQs

Can users choose how they verify (email vs mobile)?

Not exactly. The method depends on how each user logs in and what they've registered, rather than choosing each time.

  • The system prompts users who've enabled MFA in Sage People to re-verify using their registered MFA method (for example, an authenticator app)

  • Users who log in via SSO or don't use MFA for direct logins receive a one-time password (OTP) by email or text

The main point is to make sure all users register at least one verification method. This can be a supported Salesforce MFA verifier, a current email address, or an SMS mobile number they've linked to their login. If a user registers both email and SMS, Salesforce can challenge either. If they only have one, that's the method they'll use.

Note This is separate from SSO. Even in you log in to Salesforce using MFA through SSO, the system will still prompt you for either an email OTP or a Salesforce MFA option.

Can you set a timeout so you're not verifying for every report?

Yes, this is configurable. Salesforce's time-based framework lets an admin control how often the system triggers the step-up challenge.

Go to Setup, select Identity Verification, and, under Session Security Level Policies, an admin can configure:

  • Reports and Dashboards: set this to Require periodic step-up authentication when exporting or printing. This lets users view reports freely and only challenges them on an export or print

  • Step-up Authentication Period (minutes): set to any value between 1 and 120 minutes. Defaults to 120. Within that window, the system won’t challenge users on subsequent reports. It only triggers once the time you configure has elapsed sine their last step-up. So, rather than verifying every time, you can set a 120 minute window, for example. This means users re-verify at most once every couple of hours

What's not impacted?

The following are unaffected by the report export verification:

  • API access

  • Scheduled reports (Report subscriptions/Snapshots) the system sends as an attachment. However, if a user clicks a link to a report within the email then tries to export it, verification is necessary

  • Admins using the Login As feature

  • Viewing reports on screen

  • External users accessing reports via Experience Cloud (unlikely to apply to Sage People customers)

  • The Salesforce mobile app (unlikely to apply to Sage People customers)