Between April and July 2026, Salesforce is rolling out the most significant wave of platform security changes in years — mandatory MFA for all employee users, phishing-resistant MFA for admins, step-up authentication on reports, auto-containment of "high-risk" connections, and ISV connected app tightening, all compressed into roughly twelve weeks.

The destination is the right destination. Phishing-resistant credentials, identity-bound access, and auditable accountability are real upgrades over the shared-password world many of us have lived in. But the way Salesforce is getting there has been managed poorly, and the friction is hitting consulting partners — especially those serving small and mid-sized clients and nonprofits — harder than anyone else.

In this session, we'll cover what's actually changing and when (with the dates that have moved, because they have), what passkeys really are and why the synced-versus-device-bound distinction matters more than most coverage acknowledges, why this rollout hits the partner economic model specifically, and what practical preparation looks like for both your own firm and your clients. We'll close with an honest look at where the industry is heading and why "how do we keep sharing logins?" is the wrong question to organize around.

Bring your questions — including the uncomfortable ones.

Guest Speaker: Hayley Tuller

Hayley Tuller is the Founder and CEO of BrightHelm Partners, a Veteran-Owned, Service-Disabled Veteran-Owned, and Women-Owned Salesforce consulting firm serving nonprofits, higher education, and public sector organizations. A retired Navy cryptologist and linguist with 18 Salesforce certifications, she co-founded the Salesforce Jacksonville Nonprofit User Group, helped launch Nonprofit Dreamin', and contributes regularly to the Open Source Commons and to programs supporting veterans and military spouses entering Salesforce careers.