Since April 2026, Salesforce has been automatically freezing accounts that connect through anonymizing VPNs, proxies, or high-risk IPs. Separately, the platform is flagging logins that don't match a user's normal pattern. And for Salesforce Shield customers, a third change rolling out through July 2026 upgrades Transaction Security Policies from passive alerts to active step-up challenges on large report exports. Here's what each control does, what's already live, and what to tell your team before someone gets unexpectedly locked out.
Unlike the MFA and step-up authentication changes in this security series, these three controls are largely automatic. There's little for admins to configure, but a lot to understand and communicate.
Two of the three (VPN/proxy blocking and login anomaly detection) are already live as of this writing. The third (Transaction Security Policy enhancements) is a mid-2026 rollout for Shield customers.
Salesforce now blocks connections from:
Corporate or business VPNs with a known, controlled IP are unaffected. Salesforce is targeting services designed to hide a user's real location, not standard remote-access VPNs that your company controls.
This distinction matters because it means your distributed team using your company's VPN infrastructure will continue to work normally. The block is specifically for consumer VPN services that mask a user's true location.
As of April 24, 2026, this blocking extends beyond interactive login to include Connected App and API traffic. This means integrations and automated processes using anonymizing VPNs will also be blocked.
When Salesforce detects a connection from a blocked VPN or proxy, it may automatically freeze the account and revoke OAuth refresh tokens. Only an admin can review and restore access.
An AI/ML model flags novel or abnormal login patterns based on deviations from a user's typical behavior. This happens independently of whether an anonymizing proxy is involved.
Examples of anomalous logins that might trigger this:
On a significant deviation, Salesforce automatically freezes the user. This terminates all active sessions and revokes tokens. Only an admin can unfreeze the account.
This control has been active since early April 2026, so you may already be seeing frozen accounts in your org.
Transaction Security Policies are being upgraded from passive monitoring and alerting to active prevention. Instead of just logging suspicious activity, they can now actively block or challenge actions in real time.
A new default Transaction Security Policy applies to ReportEvent. When a user attempts to export a report exceeding 10,000 rows through the UI, the policy triggers a step-up authentication challenge before the export completes.
This is similar to the step-up authentication for anomalous report exports, but it's specifically for Shield customers and applies to all large exports, not just anomalous ones.
A new "Modify Transaction Security Policy" permission is being introduced to govern who can create or edit these policies going forward. This gives admins more granular control over who can change security policies.
Sandboxes:
Production:
|
Control |
Status |
Date |
|
VPN/Proxy Blocking |
Live |
April 24, 2026 (scope expanded) |
|
Login Anomaly Detection |
Live |
Early April 2026 |
|
Transaction Security Policy Enhancements |
Available in Sandbox |
June 1, 2026 |
|
Transaction Security Policy Enhancements |
Available in Production |
June 15, 2026 |
|
Transaction Security Policy Enhancements |
Enforced in Sandbox |
June 22, 2026 |
|
Transaction Security Policy Enhancements |
Enforced in Production |
July 13, 2026 |
Account takeover is one of the most common attack vectors against Salesforce orgs. Attackers use anonymizing VPNs to mask their location and make compromised accounts appear to be logging in from legitimate locations. They also use proxies to hide their true IP address.
By blocking these services, Salesforce is making it harder for attackers to hide their tracks. Combined with login anomaly detection, the platform is creating multiple layers of defense against account compromise.
If your team uses your company's VPN, they won't be affected. Salesforce only blocks consumer VPN services designed to anonymize location. Corporate VPNs with known IP ranges are allowed.
If a user tries to log in from an anonymizing VPN or from an anomalous location, their account will be frozen. They'll see an error message. You'll get a notification. Only you can unfreeze them.
There's no automatic unfreezing. You need to manually review the frozen account and restore access. This is intentional—it gives you a chance to verify that the login attempt was legitimate before re-enabling the account.
If you're a Shield customer, you'll have the ability to create Transaction Security Policies that actively block or challenge actions. The default policy for large report exports is already configured, but you can customize it or create new policies for other scenarios.
Send a message to your team explaining that Salesforce is blocking anonymizing VPN services. Use language like:
"Salesforce is now blocking connections from consumer VPN services like NordVPN and ExpressVPN. If you use a personal VPN to access Salesforce, you'll need to disable it. Your company VPN is fine. If you get locked out, contact your admin."
Include examples of what's blocked and what's not. Make it clear that corporate VPNs are unaffected.
If you're a Shield customer, test the new Transaction Security Policies in sandbox starting June 1. Try exporting large reports and verify that the step-up authentication challenge works as expected.
After the controls go live, monitor your support tickets and user feedback. If legitimate users are getting frozen, you may need to adjust your communication or whitelist certain IP ranges.
For Shield customers, monitor how often the Transaction Security Policy is triggering. If it's too aggressive, you can adjust the threshold or create exceptions.
These three controls are part of Salesforce's broader shift toward layered security. Rather than relying on a single authentication method, the platform is adding multiple layers:
Each layer makes it harder for attackers to compromise accounts and exfiltrate data. Together, they create a defense-in-depth approach that significantly raises the bar for account takeover attacks.
No. Salesforce blocks consumer anonymizing VPN services (such as NordVPN, ExpressVPN, Surfshark, and ProtonVPN) and proxy services designed to hide a user's real location. Corporate or business VPNs with a known, controlled IP range are unaffected, so a distributed team on company VPN infrastructure continues to work normally.
Salesforce automatically freezes an account when it detects a login from an anonymizing VPN, proxy, or high-risk IP, or when its AI model flags a login that deviates significantly from a user's normal pattern (for example, an unusual location, device, or time). Freezing terminates active sessions and revokes OAuth tokens.
Only a System Administrator can unfreeze the account. Review the frozen user, confirm the login attempt was legitimate, and restore access; a password reset may also be required. If the login was genuine but routed through an anonymizing VPN, an admin can request an exemption through Salesforce Support.
VPN and proxy blocking and login anomaly detection are live as of early April 2026. As of April 24, 2026, blocking extends beyond interactive login to include Connected App and API traffic, so integrations and automated processes routed through anonymizing VPNs are also blocked.
For Salesforce Shield and Event Monitoring customers, a default Transaction Security Policy on ReportEvent triggers a step-up authentication challenge when a user exports a report exceeding 10,000 rows through the UI. It becomes available in Sandbox on June 1, 2026 and Production on June 15, 2026, and is enforced in Sandbox on June 22, 2026 and Production on July 13, 2026.
Mostly no. VPN/proxy blocking and login anomaly detection are automatic and require little to configure. The main admin work is communication, documenting an unfreeze process, and, for Shield customers, testing and tuning Transaction Security Policies in a sandbox.
These login defenses are the final piece of Salesforce's 2026 security overhaul. Combined with phishing-resistant MFA, step-up authentication, and anomaly detection for report exports, the platform is creating a significantly more secure environment.
The challenge for admins is communication. Your team needs to understand why they might get locked out and what to do about it. For organizations looking to navigate these changes smoothly, consider working with experienced Salesforce consulting partners who can help you test, communicate, and optimize your security posture.
Understanding how these controls interact with sales activity tracking and territory management will also help you appreciate the broader security context. Contact us today if you want to discuss how to prepare your org for these changes.