Salesforce Step-up Authentication for Anomalous Report Exports

Overview

Salesforce is rolling out a dynamic security control that uses anomaly detection to identify unusual report activity. When Salesforce flags a user's behavior as anomalous, that user must complete a step-up Multi-Factor Authentication (MFA) check before proceeding with sensitive actions, such as exporting a report. Production enforcement began on July 27, 2026 via a gradual rollout.

This article explains what step-up authentication is, who it affects, how to prepare your users, and how it relates to Practifi.

Please note: External Experience Cloud users, such as clients or partners accessing Practifi through a portal, are fully exempt from step-up authentication. This requirement applies to internal users only.

• What Is Step-up Authentication?
• Does This Affect You?
• Preparing Your Users
• Configuration
• How This Relates to Practifi
• Additional Resources

What Is Step-up Authentication?

Step-up authentication is a Salesforce security control that adds a targeted MFA verification step when unusual report activity is detected for a specific user. It is related to, but distinct from, the existing MFA login requirement. Rather than applying to every login, step-up authentication is triggered dynamically by Salesforce's anomaly detection when a user's report behavior deviates significantly from their established patterns.

When triggered, the affected user will see a verification prompt the next time they attempt a sensitive action, such as exporting a report. This is expected behavior and is not an indication of a system fault or error on the user's part.

Does This Affect You?

For most users, nothing will change. Routine Practifi usage is unaffected, and most users will never encounter a step-up prompt. The control activates only when Salesforce's anomaly detection flags an individual user's report activity.

You are likely affected if:

• Your organization has users who run or export reports within Practifi using Salesforce's built-in reporting features.

You are NOT affected if:

• A user accesses Practifi through an Experience Cloud portal (such as a client or partner portal). These users are fully exempt.

Preparing Your Users

The most important preparation step is ensuring that every user has at least one verification method registered with Salesforce. If a user is challenged by step-up authentication and has no registered MFA verification method, no current email address on file, and no SMS-capable phone number on their account, they will be blocked from completing the action entirely.

This is especially relevant for organizations using Single Sign-On (SSO). Because SSO users may not have gone through a standard Salesforce credential setup, they are more likely to be missing a registered verification method. We recommend that Practifi Administrators review all user accounts, particularly SSO users, and confirm that each user has at least one of the following:

• A supported MFA verification method registered with Salesforce
• A current, accessible email address on their Salesforce user record
• An SMS-capable mobile phone number registered to their login

Configuration

By default, a user who has been challenged may be required to re-verify. Salesforce allows administrators to relax this requirement to once every 120 minutes, reducing friction for users who encounter the prompt during their normal workflow.

Please note: Any exemptions from step-up authentication are temporary and will expire on October 20, 2026, per Salesforce's guidance. Organizations that currently have step-up authentication disabled should plan accordingly and ensure their users are prepared before that date.

How This Relates to Practifi

This is a Salesforce platform requirement, not a Practifi change. No updates to Practifi are needed, and Practifi's functionality is not affected. However, because Practifi runs on the Salesforce platform, any report activity performed within your Practifi environment is subject to Salesforce's security controls. Ensuring your users have registered verification methods means they can complete the step-up check without disruption if they're ever flagged.

Additional Resources

To learn more about step-up authentication in Salesforce, please consult the following Salesforce documentation:

• Prepare for Step-Up Authentication in Anomalous Report Export
• Security-Related Product Updates to the Salesforce Platform

Questions?

If you have questions about this change or need help ensuring your users are prepared, contact Practifi Support.