Restriction:

Beginning with the 2026 H1 release, all new accounts are blocked from using the login form (username & password) to sign in; existing accounts are not restricted. This restriction can be turned-off for an account manually by an administrator, or automatically via import specification or API option.

After January 2027, use of the login form — even for existing accounts — will require multi-factor authentication (MFA). Clients wishing to opt out of the MFA enforcement must engage their Medallia Sales contact to execute an "Insecure User Access" addendum to your software agreement. Please do so before January 2027 to ensure no impact on your program.

Additionally and beginning with this release, all new and existing accounts with a role that includes the Do Anything permission require either single sign-on (SSO) or MFA.

Restriction: As of the Winter 2025 release, the ability to set up Email feeds is deprecated. Customers that had Email feeds prior to Winter 2025 may continue to use those exports, and they will also still be able to set up new ones. If you require the use of Email feeds, submit a Feature activation request so that teams can validate the use of this now-deprecated feature.