Salesforce Winter '27 (API 68.0) adds offline Omnistudio execution, community access to consumer-sales APIs, and mobile authentication and messaging options.
What's new
1. Run Flexcards and Omniscripts offline
Run Flexcards and Omniscripts offline on mobile devices moves data operations, input validation, and calculations onto the device. Users can open, complete, and submit Flexcards and Omniscripts without connectivity. Completed actions queue locally and sync in order when connectivity returns.
Test with connectivity off. Complete several actions, trigger validation failures, and check calculations. Then reconnect and inspect synchronization order. Test transaction boundaries and failure handling separately; ordered synchronization doesn't establish either.
2. Share Flexcard logic through autolaunched flows
Reuse autolaunched flow logic across your Flexcards is generally available. A Flexcard can use an active autolaunched flow as a data source or invoke one from an action. The data-source option is available in the Omnistudio standard designer.
Start with an operation repeated across existing Flexcards. Define the flow's inputs and outputs, then validate each consuming card before moving more logic. Keep data retrieval separate from operations invoked by a user action.
3. Test Communications Cloud additions separately
Communications Cloud updates add Communications Sales Insights to track revenue execution across the pipeline for forecast accuracy. Advanced selection mode supports bulk price adjustments on quote line items. Order capture also supports disconnecting child or grandchild products from bundles with accurate cart updates.
Enterprise Sales Management gets custom logic hooks after multi-site copy completes and direct conversion of customer assets to enterprise orders.
These deserve separate tests. Check bulk adjustments against expected prices, bundle disconnections against cart contents, and post-copy hooks against your custom logic. Test asset conversion on its own rather than folding all the additions into one workflow.
4. Review Education Cloud by workflow
Education Cloud updates introduce an attendance data model that combines instructor, parent, and device signals into one record, with an Attendance Management voice agent.
The release also adds automated refund processing for student overpayments, flexible tuition payment plans, proxy or delegated access management, and more features discoverable and configurable through Salesforce Go.
Review attendance with its operational owner. Student finance should evaluate refunds and payment plans; the access owner should review delegated access.
What to know
5. Extend consumer-sales journeys to community users
Enable customer and partner community access to Consumer Sales Connect API makes Consumer Sales Connect APIs available to Customer Community, Customer Community Plus, and Partner Community users. Those users can browse products, configure carts, and complete consumer-sales flows.
Define product, cart, and transaction access for each community user type. Run the browse-to-completion journey under each applicable user context, including attempts to access products, carts, or transactions outside the intended scope.
6. Retest large quotes and check the Trim response
Mass discount and cloning updates add the CPQ_StartMassDiscountExpanded integration procedure. It splits root items into smaller chunks so mass discounts can apply to enterprise-scale quotes that previously failed at the size limit, without recompilation or data setup.
The cloneItems API also improves handling of large data shapes that previously failed or timed out.
Put those failing quote shapes back in the CPQ test suite. Give the quoting business owner the results: which complete and which still fail.
The response needs a separate check. The GCITrimFieldsToInclude field set on QuoteLineItem controls which attributes appear in the GetCartItems Trim mode response. Compare it with the fields consuming applications require.
7. Evaluate external-browser login for Consumer Goods Cloud mobile
Enable external browser login for Consumer Goods Cloud mobile adds external-browser authentication as an alternative to the standard embedded WebView. It uses the standard Component API to preserve workflows and reduce customization and upgrade overhead.
Check it against your enterprise identity requirements and existing login customizations before deciding what to replace. Test through the authentication handoff into the mobile workflow, not just to a successful login.
What needs your attention
8. Wire the native Agentforce panel into Mobile Publisher
Launch a native Agentforce panel in Mobile Publisher apps changes the floating action button to open a native Agentforce panel through Embedded Messaging. This replaces the web-based Messaging for Web mobile flow.
To configure it:
- Add Embedded Messaging to a template footer region.
- Select a mobile deployment whose name matches its web deployment with a _mobile suffix.
- Adjust button placement with --mp-fab-bottom and --mp-fab-right.
Check that the button opens the intended native panel and doesn't obstruct app controls.
9. Review Experience Cloud maintenance and submissions
Experience Cloud maintenance and security enhancements reduce downtime risk during maintenance for sites using third-party custom domains. The updates also include efficiency gains for Aura and LWR record submissions and Orchestration Work Guide users, plus guest-user data privacy and email security enhancements.
Inventory sites using third-party custom domains, and retest an existing Aura or LWR record-submission path.
The supplied detail identifies no specific email setting or behavior change. Check the linked notes for scope before planning email security tests.
10. Review sensitive-field warnings for guest access
Pinpoint fields with sensitive data to hide from guest users adds warning icons to the Guest User Sharing Rule Access Report. The icons flag fields that may expose personal information, including account revenue, address, or contact fields. They do not automatically restrict access.
Record a keep-or-restrict decision for each flagged field. Get architect sign-off on fields you leave exposed, and send the business owner a record of what remains visible and what you've restricted.
After changing sharing rules, retest the unauthenticated journey. Intended access should still work; restricted data should no longer be available.