OAuth refresh tokens expire after 30 days of inactivity
Salesforce now limits idle OAuth refresh tokens to 30 days for all connected apps and external client apps. At enforcement, tokens idle for more than 30 days expire right away, so some users and background integrations must sign in again.
Why it matters: Integrations that sync data only occasionally can stop working without warning.
What to do: List every integration and app that uses OAuth, and confirm each one can request a new token on its own.
Sandboxes from October 21, 2026; production from November 4, 2026 (rolling)
Salesforce release note → Email verification exceptions must move to authorized email domains
If Salesforce Support disabled email verification for your org in the past, that exception goes away. To keep it, set it up yourself under authorized email domains in Setup. Otherwise, users with unverified addresses can no longer send email from Salesforce.
Why it matters: Sales and service teams could lose the ability to send email from Salesforce.
What to do: Check Release Updates for this item. If it appears, configure your authorized email domains before the deadline.
Enforced December 1, 2026
Salesforce release note → SOAP API login() needs the Use Any API Auth permission
Every user who signs in through the SOAP API login() call must have the Use Any API Auth user permission. Users without it get an error.
Why it matters: Older integrations and tools that still use SOAP login can fail.
What to do: Find the integration users that use SOAP login() and assign the permission through a permission set.
Enforced across all orgs and environments beginning December 1, 2026
Salesforce release note → Username-password and user-agent OAuth flows retire
Salesforce is retiring the OAuth 2.0 username-password flow for connected apps and the OAuth user-agent and hybrid user-agent flows. Integrations that use these flows will stop working. Both release updates were postponed to the same date.
Why it matters: These are common in older or homegrown integrations, and they break completely when the retirement takes effect.
What to do: Move user logins to the web-server flow with PKCE and server-to-server jobs to the client credentials flow. Ask vendors of installed apps for their plan.
Enforced February 20, 2027
Salesforce release note → Connected apps should be migrated to external client apps
Salesforce is ending support for connected apps. They keep working, but Salesforce will no longer fix bugs or support the integrations and authorization flows that use them. Setup includes a Migrate to External Client App button that creates the new app for you.
Why it matters: Unsupported integrations become a growing risk to uptime and security.
What to do: Inventory your connected apps, test the migration in a sandbox, and plan a cutover before Summer '27.
Enforced for production instances in Summer '27
Salesforce release note → Salesforce for Outlook retires in January 2027
Salesforce for Outlook will stop syncing contacts, events, and tasks, and users lose its side panel. The retirement date moved earlier than first announced. Salesforce recommends the Outlook integration and Einstein Activity Capture instead.
Why it matters: Teams that log email and meetings through the old plugin will lose that sync.
What to do: Identify who still uses Salesforce for Outlook and move them to the Outlook integration and Einstein Activity Capture.
Retires January 30, 2027
Salesforce release note → Agentforce platform is turned on by default
The Agentforce platform is now on by default for orgs that have Agentforce access through licensing. Existing orgs are enabled on a rolling basis. Salesforce says there is no added cost and no billing change. Admins get Agentforce Builder access, and other users need permissions.
Why it matters: Admins can start building agents with one less setup step, while individual agents stay off for users until activated.
What to do: Review who holds the Manage AI Agents permission and confirm your governance for activating agents.
Rolling enablement for existing orgs began the first week of September 2026
Salesforce release note → Agent Memory for Agentforce agents is generally available
Agentforce agents can recall relevant details from a user's past conversations and use profile details such as name and time zone from the first message. Admins turn it on in the agent's Script view in Agentforce Builder.
Why it matters: Customers and employees no longer have to repeat themselves each time they start a conversation.
What to do: Decide which agents should remember past conversations, and review your data and privacy policy before turning it on.
Available in orgs upgraded to Winter '27 starting the week of September 21, 2026
Salesforce release note → Flows can be forced to always run with the user's permissions
A new run option, User Context - Enforces User Permissions, makes a screen flow or autolaunched flow always run with the running user's access. Before, a flow set to user context could inherit system access from whatever called it. It applies to flows on API version 68.0 or later.
Why it matters: Sensitive automations get a predictable security boundary.
What to do: Review flows that touch sensitive data and switch them to the new run option where it fits.
Salesforce release note → Data 360 data graphs get field-level and record-level governance
Data 360 now prunes restricted fields, masks data, and excludes unauthorized child data model objects in data graphs based on your governance policies. This replaces the earlier all-or-nothing access model and is turned on automatically.
Why it matters: Several users and AI agents can share one data graph while each sees only what they are allowed to see.
What to do: If you relied on child object restrictions to block a whole data graph, add an explicit deny policy so nothing becomes visible by accident.
Rolling availability starting August 2026
Salesforce release note →