New Security Control Requirements Beginning June 2026

On Wednesday 3/25 Salesforce sent an email (Subject: Action Needed: Upgrade the Security of Your Salesforce Experience), the second section of the email was titled "New Security Control Requirements Beginning June 2026".  The list includes:

1. Require Multi-Factor Authentication (MFA)
2. Ensure all System Administrator users adopt Phishing-Resistant MFA for login
3. Restrict Login IP Addresses in Profiles
4. Enable a Transaction Security Policy (TSP) that Restricts Large Data Exports
5. Avoid Connecting from Anonymizing Proxies and High-Risk IP Addresses

And "We will be announcing a roadmap of additional security control requirements and timelines in the near future

." 

First, yay for the forthcoming roadmap!!!  Very exciting, eager to track this and hope it will be maintained ongoing! 

Regarding #2 (phishing-resistant MFA for System Admins), any additional information on this, particularly as it relates to SSO?  Will MFA through SSO still meet this requirement, or does Salesforce have plans to enforce Salesforce Authenticator for System Admins, even if SSO is in place? 

Regarding #4 (TSP for large data exports via ReportEvent), we eagerly await more details on this one, with some trepidation.  Some analytics tools (e.g., Power BI) rely on a report-connector to integrate for some use cases, so a TSP policy that drives "stepped up" authentication sounds low-impact for reports accessed by human users, but would likely be high-impact when unattended users are involved.  I hope Salesforce is considering such scenarios when the additional communication is provided, and will also provide targeted guidance on how to handle to avoid disrupting business.   (Along with adequate lead time to test the changes.) 

Thanks!