Our Outcry is Heard

Good news! Salesforce has listened to the outcry from the community and realized that the terrible user experience I described in my last post would be disastrous. They've already rolled out some fixes that make things better and they're (at least reportedly) working on more.

Timeline

It would be a fool's errand for me to try to detail when particular changes are coming to your sandboxes or to production. The dates and content for security changes around phishing resistant multi factor authentication and those around step-up reporting have already changed several times, including a full delay in implementation at least once. So I can't keep up with any date changes that could be announced between when I write this, when it's published, and when you read it.

As of the moment I'm typing this, the schedule for step-up authentication in production instances is "Starting July 1, 2026, staggered over approximately 30 days." It's that start date that's changed at least once already and could change again. I believe this Help document will stay updated with any new information.

What's Already Changed

Salesforce deployed a fix so that the truly terrible experience I detailed in my last post, where embedded dashboards on a home page showed an error, is no longer the case. Yay for that! The Help document was updated on June 2 to reflect that change.

As of my writing this post, I haven't seen it yet (because rollout starts on 6/15), but another patch is also being deployed in which step-up will trigger when exporting or printing reports, but not when the Reports tab is accessed nor when a report is simply viewed. I assume this will similarly apply to dashboards, but I haven't seen documentation about this patch yet.

Quick Tip: Know Your Patch Version

If you're logging into your sandbox to test these changes, you may wonder whether you've got the latest update with the fixes you're watching for. Did you know that there's a faster way than going to trust.salesforce.com? Just append /releaseVersion.jsp to your org domain and you'll know your release and patch version instantly!

Reminder here about Sprinty's Community Resources. You don't have to keep all these tips in your head.

What Might Still Change

I'm told the team is "looking at" the insanity of the step-up ping moments after the original login. No confirmation yet that it will be better before enforcement. But they understand the community's frustration around this. I have hope.