Communications & Readiness Connect

⛰️🛡️ New Hands-on Workshop for Premier & Signature Developers: Secure the Code: Find and Fix Vulnerabilities (DEX003) 

Insecure custom code is one of the leading causes of data breaches. In this 90-minute instructor-led workshop, you'll step into the role of a security-focused developer to audit and remediate critical vulnerabilities in Lightning components and Apex classes through a series of challenges.  

This hands-on workshop teaches developers how to prevent script injection, encrypt data securely, manage secrets, and control record access. You'll also learn to identify authentication flaws and data exposure risks. this practical workshop is for developers working with custom code at any stage: 

• Build new code — learn to bake in secure patterns from the start, so vulnerabilities never make it to production
• Review existing code — sharpen your eye for spotting injection flaws, insecure data handling, and access control gaps in code you didn't write
• Maintain and harden production orgs — Use the Developer Console or VS Code to apply Salesforce platform security best practices that protect applications from evolving threats

Sessions are live and available! :calendar:

• Wed Sep 2 — 3:30pm CET/Paris
• Tues Sep 8 — 3:30pm ET/New York
• Mon Sep 21 — 9am IST/Kolkata
• Mon Oct 19 — 9am ET/New York
• Check the session listings for additional workshops across regions :tada:

Interested in the Admin version of this security workshop? Check out upcoming sessions for ADX012

👉 Premier and Signature customers — Register today on Trailhead Academy — Course code: DEX003

#Salesforce Developer #Slack Developers

🎉 Big shoutout to our incredible Forum Ambassador, @Manoj Nambirajan for an awesome deep dive on "Send Opportunity Notification for Specific Stage Movements"!📘 Check out the article here >> https://help.salesforce.com/s/articleView?id=005393369&type=1 

🔍 Found it helpful? Have thoughts to share?

 Let us know by clicking the "Yes" or "No"  button at the bottom of the article—your feedback helps us improve!> 🔍 Found it helpful?" style="display: block;" /> #Flow

⛰️ 🔐 New Hands-on Workshop for Premier & Signature Admins: Secure the Org: Find and Fix Vulnerabilities (ADX012)

 Misconfigured security settings are one of the leading causes of data breaches. In this 90-minute instructor-led workshop, you'll step into the role of an internal security auditor to identify and fix real Salesforce vulnerabilities across the most common misconfiguration areas. 

This workshop was adapted from a fan-favorite capture-the-flag game that has been a hit at live Salesforce events — now available virtually so more admins can play! This practical workshop is for:

• Newer admins — you'll find the challenges approachable and manageable. The hands-on format makes security feel less daunting and more actionable
• Seasoned practitioners — you'll likely discover security settings you haven't previously been aware of
• All learners — challenges are independent of each other, so you can move at your own pace, skip ahead, and circle back with no pressure

Sessions are live and available!

• Fri Jul 31 — 9:00am ET [AMER]
• Mon Aug 3 — 3:30pm ET [AMER]
• Tue Aug 11 — 10:00am CET [EMEA]
• Check the session listings for more workshops across regions 

➡️ Premier and Signature customers — Register today on Trailhead Academy — Course code: ADX012

#Security

*** Important updates: MFA Enforcement Update: R1 Window Rescheduled to July 27-28 ***We wanted to give you a heads-up that the R1 MFA enforcement window has been updated. Here's what you need to know:

What Changed

The R1 enforcement window has moved from July 21–22 to July 27–28.

Why the Change

We made this adjustment to address a few things:

• Additional time was needed to fully process previously approved extensions
• Some SSO users on orgs with approved extensions were being unexpectedly prompted for MFA

If You Have an Approved Extension

Keep in mind that approved extensions can take up to 48 hours to take effect, so you may still see MFA prompts during that window.

If your org has an approved extension but you're still being prompted for a passkey, please refer to this Knowledge Article for detailed guidance on specific use cases.

What's Not Changing

• The MFA for All schedule remains the same
• R2a, R2b, Japan & Korea, and all subsequent release groups are on their original schedules

Where to Find the Latest Info

The PRMFA Knowledge Article has been updated to reflect the new R1 window — that's your best source for the current schedule and details.

Have questions? Drop them in the comments below and we'll do our best to help! 

💡*** Sandbox Instance Refresh: Happening on August 16, 2026 ***💡 Curious about what an instance refresh entails?  

It's essentially an upgrade to the infrastructure supporting your instance within our data centers.  Following this maintenance, your instance will move to a new data center, and the name of your instance will change.   

📍 Maintenance Mapping: 

Please take this opportunity to review our Instance Refresh resources linked below:  

Instance Refresh FAQ  

How to Prepare for the Instance Refresh  

How will an org be impacted during the Salesforce maintenance

Action Required: Upcoming Change to Data 360 Query Service v2 APIWhat's happening?  

On August 1, 2026, Salesforce is changing the format and length of the identifier used to retrieve the next batch of data. This change applies to the Data Cloud Query Service v2 Connect API and Direct API endpoints.  

Currently, when a query returns a large result set, the API response includes a unique identifier to retrieve the next batch of data. This change might affect client applications that depend on the identifier’s current format.

If you have applications that depend on the current format, length, or structure of this identifier, update them before August 1, 2026. However, no action is required if an application already treats this identifier as a plain string. This update doesn’t affect the core functionality of Data Cloud Query Service v2 API.

If you don’t update your applications before August 1, 2026, you might experience unexpected behavior or disruption to your data retrieval workflows.

For more information on preparing for this update, see the Knowledge Article. 

*** Important change for: All Core Org Admins & Security Contacts ***This update is limited to Salesforce Platform. 

In Progress Enhancements: Immediate Action Required

Salesforce is enforcing these controls now. To avoid service disruption, verify your configuration. 

• Email Domain Verification: Email domain verification is now required to send emails from Salesforce. Learn more about the change and the enforcement timeline.
• High-Risk Connection Blocking: Ensure that your users aren’t connecting to Salesforce via anonymizing VPNs, proxies, or high-risk IP addresses. Salesforce monitors for and blocks high-risk connections through Connected App or API usage and anomaly detection for login activity.

Upcoming Enhancements: Take Action Now

Detailed enforcement dates for each control are available in the linked resources.

• Phishing-Resistant Multi-Factor Authentication (MFA) for Privileged Users, including Admins: Phishing-resistant MFA will be enforced for System Administrators and users who have certain privileged permissions when they log in to any org, including sandboxes. This requirement applies to direct UI and Single Sign-On (SSO) logins. Learn more about how to set up this feature and the enforcement timeline.
• MFA for All: MFA will be enforced for all employee license users who log in via the Salesforce UI or Single Sign-On (SSO) to all orgs, including sandboxes. Learn more about how to set up this feature and the enforcement timeline.
• Step-Up Authentication: Salesforce will enforce identity verification challenges for all users (including those using SSO) when they perform high-sensitivity actions, starting with UI report exports and viewing, and for anomalous behavior while accessing reports. This change applies across all orgs, including sandboxes. To prepare for this change, ensure that your users each have one of the following registered: Salesforce MFA, a current email address, or a mobile phone number. To learn more about how to prepare for this change, see Prepare for the upcoming Step-up Authentication requirements on Report Actions and Prepare for Step-up Authentication in Anomalous Report Export.
• Upcoming Transaction Security Policy (TSP) Enhancements (Shield & Event Monitoring customers): Salesforce will automatically deploy a default TSP for ReportEvent. When enabled, this policy triggers a step-up authentication challenge for UI report exports that exceed 10,000 records. Additionally, a new "Manage Transaction Security Policy" permission will be required, in addition to the "Customize Application" permission, to manage any TSP. Review and assign this new permission to authorized users before enforcement. Learn more about how to set up this feature and the enforcement timeline.

Strongly Recommended but Not Required at This Time

This control is recommended but not mandatory as previously announced.

• IP Address Restriction: Salesforce isn’t enforcing the IP address restrictions in profiles or the “Enforce login IP ranges on every request” session setting at this time. However, we continue to strongly recommend that you adopt IP address restrictions and enable the setting, and we may require that configuration in the future. To learn more about how to configure your IP Allowlist permissions, see Restrict Login IP Addresses in Profiles and Set Trusted IP Ranges for Your Org.
• Phishing-Resistant MFA for Non-Admin Users: To ensure the highest level of protection against identity-based threats, Salesforce strongly recommends that you implement phishing-resistant MFA for all users. See Prepare for MFA Enforcement for All Employee Users.

More Information

Join one of these webinars where Salesforce experts will discuss these changes.

• Platform Security Enhancements Webinar Option 1 | May 13 15:00-16:00 UTC
• Platform Security Enhancements Webinar Option 2 | May 13 23:00-24:00 UTC

🎉 Big shoutout to our incredible Forum Ambassador, @Piyusha Pilania for an awesome deep dive on "Calculate Business Hours duration between two Timestamps"!📘 Check out the article here >> https://help.salesforce.com/s/articleView?id=005321712&type=1 

🔍 Found it helpful? Have thoughts to share?

 Let us know by clicking the "Yes" or "No"  button at the bottom of the article—your feedback helps us improve!> 🔍 Found it helpful?" style="display: block;" />

🗞 [Product & Service: Monthly Buzz] June 2026 🗞NEW CONTENT EVERY MONTH! Be sure to read the best of our content in your inbox 

🚀 Community Highlights 

This month we saw amazing engagement across the community:

• 809 questions answered by community experts
• 21% Accepted Answers by community members

A big thank you to everyone who continues to support and help others in the community! 

 Here are a few updates you should know about: 

1. Step-Up Authentication for Report Actions. Read more here >> 

https://trailhead.salesforce.com/trailblazer-community/feed/0D5KX00000pNc5L0AS

2. Add Custom Link to Lightning App Record Page. Read more >> 

https://trailhead.salesforce.com/trailblazer-community/feed/0D5KX00000pNIVX0A4

3. Step-Up Authentication for Report Actions. Read more >> 

https://trailhead.salesforce.com/trailblazer-community/feed/0D5KX00000pNc5L0AS

🏆 Member Spotlight

This month we’re recognizing  Eric Burté for an awesome deep dive on "Manage Duplicate Leads & Contacts in Salesforce"

💡

We published two Knowledge Articles under the topic #Contacts#Contacts & #SalesCloudEssentials#SalesCloudEssentials with the help of our Forum Ambassadors, @Eric Burté & @Piyusha Pilania. Thank you for your valuable contributions. 

The topics included: 

1. Manage Duplicate Leads & Contacts in Salesforce. Read more >> https://help.salesforce.com/s/articleView?id=005386514&type=1

2. Calculate Business Hours duration between twTimestamps. Read more >> 

https://help.salesforce.com/s/articleView?id=005321712&type=1

❤️ Thank You

Thank you for to everyone for being part of our growing community. Your participation and engagement make this space valuable for everyone. 

#Product#Product & Service New

*** Important Update: Step-Up Authentication for Report Actions ***Hey Trailblazers! We have some important updates to share about the upcoming Step-Up Authentication requirement for Report Actions —  Here's what you need to know: 

Change 1: Step-Up Challenges Now Scoped to Export Actions Only

Step-Up Authentication challenges will now trigger only when exporting or printing reports — not when simply viewing reports, dashboards, or accessing the Reports/Dashboards tabs in the UI. 

The Session Level Policy setting has been added to reflect this:

 "Require periodic step-up authentication when exporting or printing"

This updated policy replaces the prior setting upon enforcement. Find this by going to Setup -> Identity Verification and selecting the new policy for Reports and Dashboards. 

Change 2: Profile Login IP Restrictions as an Alternate Control

Step-Up Authentication for report exports will not be required when both of the following conditions are met:  

• A user's Profile has Login IP restrictions configured, AND
• Either the user's IP address hasn't changed between login and report export, or "Enforce login IP ranges on every request" is enabled in Session Settings

This gives admins a meaningful alternate control if your org uses IP-based access restrictions and when configured, users will not see step-up challenges during report export. 

Enforcement Timeline — No Changes  

Enforcement dates remain unchanged from what was previously published:

• All Sandboxes: June 17 – June 24
• Production: July 1 – July 25

 Additional Resources

•  Prepare for the upcoming Step-Up Authentication requirements on Report Actions (Updated June 16, 2026)
• Restrict Login IP Addresses in Profiles

Have questions? Drop them in the comments below — we're here to help!