It just started today, 7/22, that when staff export reports, they are asked for verification code.
When they enter the code from the authentication app, it doesn't work and just keep looping.
I tried to generate temporary verification code via staff's user account. An email was sent to them but no code and no link, nothing. I don't have the code either. so dead-end.
We use MS SSO for staff to get in Salesforce. Our IT people just enabled passkey method on the network. One staff set up passkey successfully and she could now export reports fine. However, two other staff can't set up passkey, the same, got stuck on verification code screen.
I don't know what else to do. Please advise.
Please review these areas in the sandbox within Setup:
Session Settings
Look for the session-level policy named approximately:
- Also review the Reports and Dashboards access policy under the sensitive-operation or session-security settings. Depending on the release and org configuration, it may show options such as:
- None
- Block access
- High Assurance required
- Raise the session level with step-up authentication
Salesforce is making parts of the report-export step-up framework mandatory, so the option may be enabled automatically, locked, or scheduled for enforcement.
Regarding whether or not you can you eliminate the second screen:
For report exports governed by Salesforce’s new step-up framework, probably not. Enforcing phishing-resistant authentication through Entra does not currently cause Salesforce to accept the Entra challenge as the verification for this Salesforce-controlled export action.
The practical approach is to:
- Continue using Entra passkeys for the initial SSO login.
- Register the same device’s platform passkey directly in Salesforce, where supported.
- Educate users that report exports may require a separate Salesforce verification.
- Restrict report-export permissions to users who genuinely need them.
- Check Setup → Identity Verification History to confirm that the second challenge is being recorded as a Salesforce step-up event.
I would also open a Salesforce Support case and explicitly ask:
That said, based on Salesforce’s current published guidance, the answer appears to be that
external IdP MFA cannot satisfy this particular step-up requirement.
