Salesforce is Breaking Salesforce
Summary
Salesforce is enforcing step-up authentication for viewing reports and dashboards starting July 2026, which causes major usability issues including repeated MFA prompts even immediately after login. This change breaks embedded dashboards, shared logins, and admin troubleshooting with Login As, making the platform less functional especially for executive users relying on single-dashboard apps. The MFA session doesn't start on login, requiring a second step-up ping that is unintuitive and disruptive. Salesforce plans patches, but the rollout is rushed and currently poorly designed, risking user frustration and decreased adoption. Admins and consultants are encouraged to request enforcement delays and provide feedback to improve the experience.
Takeaways
- Step-up authentication will require MFA for any report or dashboard viewing starting July 2026.
- Embedded dashboards won’t trigger step-up MFA, showing errors until user clicks Reports or Dashboards tab.
- SSO logins don’t count towards step-up MFA, forcing additional MFA prompts for users.
- Admin 'Login As' feature is broken for troubleshooting report/dashboard MFA issues currently.
- Request enforcement delay from Salesforce Support citing business impact concerns.
Salesforce is about to make their own flagship product (the Salesforce platform) practically unusable . No joke. The added security of the Step-Up Authorization to view reports and dashboards is going to be enforced on or about July 1 (it’s actually staggered over 30 days). Though it’s not enforced in Sandboxes until June 17, you can test how it’s going to work already if you’ve got a sandbox on Summer ‘26. Bottom line: It’s bad. It's gonna break reports and dashboards. And I've written before that reports and dashboards are kinda Salesforce's superpower, a main selling point for the platform over other CRM or online database options. To the best of my knowledge, this post is accurate as of 7:15pm Eastern on June 2nd. It’s possible that by the time it’s published or by the time you read it that a patch will have changed some of the behaviors I’m writing about. A few minutes ago Salesforce announced a delay of the enforcement schedule.