IMPORTANT: Salesforce has rolled out a security update that adds a step-up authentication challenge on requests that access report data. This update has led to numerous Higher Logic customer reports failing to sync.

Impact of this update

This impacts Higher Logic accounts that are integrated with Salesforce and that sync data from Salesforce reports (for example, report-based target groups or lists).

What happens

Higher Logic's integration with Salesforce connects non-interactively; it is a background, API-based connection that cannot respond to an interactive login or a verification prompt.

When Salesforce's step-up challenge is triggered, Salesforce returns a login/verification page instead of the requested report data. Because Higher Logic cannot complete an interactive challenge, it cannot read the report, and the sync fails.

As a result, affected customers might see:

• Salesforce report-based target groups / lists are out of date or show errored counts in Higher Logic.
• Report syncs fail or stop refreshing.
• Mailings fail to send. For example, a mailing that draws its audience from a Salesforce report group may fail with a generic failure, such as "Mailing Failed — Failed Reason: General Failure."

NOTE: The integration login is typically still valid and the integration connection still "up." The failure happens after login, in the step that requests the report data. This is a change in Salesforce; no change is required inside Higher Logic, and the integration user does not need to be enrolled in multi-factor authentication (MFA).

Getting help

The remedy to this situation requires:

• knowing which Higher Logic product you're using;
• knowing which IP-addresses (or address range) apply to your Higher Logic product; and
• being able to access the "integration user" profile in Salesforce.

If you are unsure about any of the above or if the sync continues to fail after following the instructions in this article, create a case with Higher Logic Support and reference this article. Also include the affected report/target group name and any error message that displays.

Remedial action

NOTE: Requests that originate from a trusted (allow-listed) IP-address range are not subjected to the step-up challenge, which allows the report sync to run normally.

To restore report syncs, add Higher Logic's connection IP addresses in the Login IP Ranges section on the Salesforce profile that is assigned to the Higher Logic integration user.

IMPORTANT: You must have administrator permissions in Salesforce in order to complete the following steps in your Salesforce account.

To add Higher Logic's connection IP addresses:

1. Go to Setup.
2. In the Quick Find box, search for Profiles and open Profiles.
3. Open the profile that is assigned to your Higher Logic integration user (i.e., the account that Higher Logic uses to connect to Salesforce). The Login IP Ranges section is located under the profile's login IP / step-up authentication section.
4. In the Login IP Ranges section, click New.
5. Specify the IP Start Address and IP End Address for your Higher Logic product.

TIP: Higher Logic's product-specific IP addresses are listed in a table in the next section.

6. Click Save.

TIP: You should repeat these steps for each range that applies to you.

NOTE: If you have more than one Higher Logic account connected to Salesforce, apply this to the profile used by each integration account.

After a few minutes, re-run / re-sync the affected report-based target group in Higher Logic to confirm.

Higher Logic connection IP ranges

The following table lists the IP Start Addresses, IP End Addresses, and IP Ranges for the Higher Logic product suite. Be sure to use the appropriate Start and End addresses for your Higher Logic product.

NOTE: If you are unsure which Higher Logic product you have or which IP addresses apply to you, or if the sync still fails after you've added the IP addresses, create a case with Higher Logic Support.

Confirm the integration user settings

While you are in Salesforce, confirm that the Higher Logic integration user is configured so the sync can continue to run. Ensure that the integration user:

• is active (not frozen or deactivated).
• retains full read access to the objects, fields, and report folders being synced. A dedicated profile is preferred (with copied permission from the System Admin profile) to ensure that the integration can reach all the required data.
• can Run Reports and Export Reports and can access the report folders that contain the synced reports.

Confirm the fix

After completing and saving the Login IP Ranges section in Salesforce, re-run the affected report-based target group / list sync in Higher Logic and confirm:

• the group's counts update and
• that no report/API error is returned.

Optional manual check

Log in to Salesforce as the integration user and run/export the report.

• If the report data (CSV) is returned rather than a login/challenge page, the exemption is working.

NOTE: Mailings that failed while the sync was broken do not resend automatically. After the sync is confirmed to be working, copy/recreate the affected mailings and re-send them so they are delivered to the corrected audience.

If the issue returns...

If report syncs start failing again after having previously worked:

• Check whether the addresses in the Login IP Ranges section or the integration user's permissions were recently changed in Salesforce.
• If necessary, re-add the correct addresses and re-confirm the integration user's report Run/Export access.

NOTE: If the fail persists, create a case with Higher Logic Support with the error text and your account/brand so we can confirm the correct IP addresses and permissions for your account.

Salesforce Help link

Salesforce is the authoritative source for information on this security update. Higher Logic provides the following "Salesforce Help" link for convenience.

• Prepare for the upcoming Step-up Authentication requirements on Report Actions
  
  https://help.salesforce.com/s/articleView?id=005321566&type=1