Upcoming Salesforce changes, by date

Redirections end in sandboxes for instanced URLs in API traffic, and orgs using third-party services for custom domains must update their target host names.

Introduces a dedicated View Setup Audit Trail permission allowing admins to grant setup audit trail access to users without providing full View Setup access.

Redirections for instanced URLs in API traffic are ending in sandboxes. Third-party served custom domains must also update their target host name.

Apex classes and triggers saved at API versions 9.0 through 19.0 will be retired in a future release, and the Apex compiler now warns when you compile or deploy code at those versions (in Setup, Salesforce CLI, VS Code extensions, Web Console, and Tooling API). Update affected classes and triggers to API version 20.0 or later; managed package code at these versions must be fixed by the package developer. This retirement is unrelated to the Salesforce Platform API retirement and does not affect Visualforce, Flow, or Process Builder versions.

To authenticate with the SOAP API login() operation, users must be assigned the Use Any API Auth user permission, or authentication will fail.

API traffic relying on instanced URLs must be updated to use the organization's My Domain login URL to maintain uninterrupted API access.

Limits on procured phone numbers are now enforced for Agentforce Voice, setting a maximum of 10 phone numbers for sandbox and trial orgs and license-based limits for production orgs.

Migrate packaged and distributed connected apps to packaged external client apps to reduce security risks.

Prepares orgs for email becoming the default login experience alongside new security requirements taking effect in Summer 2026.

Release updates turn on profile filtering by default and introduce updated behavior during sharing recalculation.

This Release Update decouples guest-user field masking from portal-user masking: turning on Independent Guest Field Masking makes the PII that unauthenticated guest users see governed by a new Guest_PersonalInfo_EPIM field set, while portal users stay governed by PersonalInfo_EPIM. Enforced in Spring '27; review and activate from Setup > Release Updates.

Agentforce Voice enforces limits on procured phone numbers, adhering to production licenses and capping sandbox and trial orgs at 10 phone numbers.

A notification indicates that Salesforce enforces new security requirements beginning in Summer 2026.

Profile filtering is enabled by default to prevent users from viewing profile names other than their own unless they are assigned the View All Profiles permission.

Prevents installed managed package session IDs from authenticating and executing anonymous Apex code.

Redirections end in sandboxes for instanced URLs in API traffic, and target host names must be updated if custom domains are served by a third party.

Salesforce is ending support and bug fixes for connected apps in Summer '27, requiring migration of integrations to external client apps.

Use keyword and natural language search to discover relevant report types. Turn on this feature by contacting Salesforce Customer Support.

The Experience Delivery infrastructure for LWR sites, a beta feature, is discontinued as of Winter '27 (October 2026). Republish any site still hosted on Experience Delivery so it migrates to standard LWR infrastructure; sites that aren't republished keep working but can degrade over time.

From Winter '27, calling window.open(url, '_blank') (or omitting the target, which defaults to _blank) for a same-origin Salesforce URL throws a LockerSecurityError under Lightning Web Security for Aura, so code that opens same-origin links or downloads in a new tab breaks. Replace those calls with a programmatically created, detached anchor element that sets href, target='_blank', and rel='noopener noreferrer', then calls click() without appending to the DOM. For same-tab navigation use window.open(url, '_top') or set a.target to '_top'/'_self'/'_parent'.

Bulk API, SOAP API, REST API, and every REST API under /services/data/vXX.X/ (Connect REST API, Metadata API, Tooling API, Place Order, Reports and Dashboards, and more) at versions 31.0 through 40.0 are being deprecated in Summer '27 and retired in Summer '28. After deprecation these versions get no security or bug fixes; after retirement calls to them fail. Move all integrations to API version 41.0 or later.

The Unified Employee license no longer supports access to custom objects unless the object comes from a security-reviewed managed AppExchange package. You can't assign profiles, permission sets, or permission set groups that include restricted custom objects to Unified Employee licensed users, and you can't add restricted custom objects to profiles or permission sets already assigned to those users. To grant full custom object access, move the user to a license such as Salesforce Platform.

Lightning Sync is scheduled to retire in 2027. Migrate to Einstein Activity Capture with the Lightning Sync migration tool in Setup, assign EAC permission set licenses, confirm users are in an active EAC configuration, then turn off Lightning Sync. You can't migrate with Exchange Web Services (EWS) as the auth method, so upgrade Lightning Sync from EWS to Microsoft Graph before October 2026 first.

The Sales Engagement Performance Dashboard is scheduled for retirement in November 2026. Use the Sales Engagement Sample Dashboard to access Sales Engagement data instead.

Salesforce for Outlook is retired in December 2027, after which it no longer syncs contacts, events, or tasks and its features (such as the side panel) become unavailable. Move to the Outlook integration and Einstein Activity Capture.

Microsoft retires Exchange Web Services (EWS) for Microsoft Office 365 in October 2026, after which Einstein Activity Capture configurations on EWS stop syncing. Use the single-click upgrade tool to move to Microsoft Graph authentication; new EAC + Microsoft 365 setups from Spring '26 already use Microsoft Graph. If EAC uses User-Level OAuth, users must reconnect their accounts.

Because Microsoft retires Exchange Web Services (EWS) in October 2026, transition Salesforce Inbox's Microsoft 365 authentication from EWS to Microsoft Graph using the upgrade tool; users must reconnect their Microsoft 365 accounts. New Inbox + Microsoft 365 setups from Spring '26 already use Microsoft Graph.

Agentforce IT Service moves to a clear ownership model: Incident Owner for individual or queue ownership and Assigned Group (public groups only, not queues) for team ownership. For orgs created after Winter '26 the legacy Assigned User field is hidden by default and inaccessible via API, so update integrations to use Incident Owner. Existing orgs can still use Assigned User but should transition.

Activity 360 Reporting, Activity Metrics, and the Activities Analytics Dashboard are being retired because they aren't compatible with email synced as Task and EmailMessage records; the related objects UnifiedEmail, UnifiedEmailParticipant, UnifiedMeeting, UnifiedMeetingParticipant, UnifiedTask, and UnifiedTaskParticipant are also scheduled to retire. Turn on Sync Email as Salesforce Activity (via Update & Migrate in Setup) and rebuild reporting on standard Task/EmailMessage data, SOQL, and APIs. This also affects Prospecting Center, Pipeline Inspection, and Einstein Conversation Insights.

You can now track agent-influenced orders, conversion rate, and average order value for the B2C Shopper Agent across an SFRA storefront and compare against site-wide baselines in Business Manager Reports & Dashboards. Analytics now come from the Agentforce Commerce Client, delivered by the new plugin_commerce_client cartridge, which replaces the retired plugin_shopper_agent cartridge, so install or redeploy the latest cartridge from the Salesforce CommerceCloud repo.

The Data Cloud Profile Engagements widget has reached end of life and is replaced by the Data 360 Engagement Timeline, a Lightning App Builder component that shows engagement data in chronological order on Account, Contact, Lead, Person Account, and Prospect records and can surface up to 10 engagement types. Rebuild affected record pages on the new component: configuring it needs Data 360 access plus the Customize Application permission, and viewers need a Data 360 license, access to the configured data space, and explicit object-level access to each engagement object (control-by-parent is not supported).

Einstein Quick Quote for Enterprise Sales Management is retired in Winter '27. Along with it, the Contract Option in Custom Discount Allocation Type settings and the sort functionality on the Product Catalog are also retired.

Revenue Cloud for Communications now configures with the ConsumerSalesContext context definition. Pricing procedures and rule libraries that previously referenced the old context definition extensions must be updated to reference ConsumerSalesContext.

Marketing Cloud Engagement adds tooling to rotate client secrets for installed packages, automatically revoke secrets flagged as compromised in a follow-up security review, and review client secret statuses on the Installed Packages summary page. Audit and rotate any integration secrets ahead of enforcement.

Marketing Cloud Next landing pages hosted on retired infrastructure can degrade in performance; republishing a page moves its content to supported infrastructure without changing content. Check the Publication Calendar in your Content Workspace and republish any landing page not published in over 6 months. Effective October 2026.

This Release Update optimizes the Configuration API to reduce configuration processing times when using Product Configurator. It's available starting in Winter '27; enable the test run in a sandbox to confirm the optimizations work with your setup before enforcement.

A WCAG 2.2 Resize and Reflow Release Update that keeps cards, docked containers, menu lists, and panels readable at 400% magnification and 1280px width by wrapping header content instead of clipping it. It depends on the Page Headers and Modal Windows accessibility Release Update being enabled first. Enforced in Winter '27; test and activate from Setup > Release Updates.

A WCAG 2.2 Resize and Reflow Release Update that adjusts date pickers, popovers, bottom utility bars, and record list-view headers so they stay usable at 400% magnification and 1280px width; truncated utility-bar button labels reveal their full text on hover or keyboard focus. It depends on the Page Headers and Modal Windows accessibility Release Update, which must be enabled first. First available in Winter '26, with enforcement moved from Summer '26 to Winter '27. Activate from Setup > Release Updates.

This Release Update makes Lightning Experience adapt page headers and modal windows for users viewing the browser above 200% zoom, as part of Salesforce's WCAG 2.2 Resize and Reflow effort: the page header scrolls with the page instead of covering content, and modal buttons and content stay inside the viewport. It was first offered in Summer '25 with enforcement postponed from Summer '26 to Winter '27, and the other Winter '27 accessibility Release Updates depend on this one being enabled first. Test and activate it from Setup > Release Updates before the enforcement date.

A WCAG 2.2 Resize and Reflow Release Update that keeps To Do lists and Lightning dual listboxes usable at 400% magnification (1366px width) by wrapping content rather than clipping it. Unlike the other Winter '27 accessibility Release Updates, this one is scheduled for enforcement in Spring '27. Activate from Setup > Release Updates.

Salesforce Functions is no longer available for purchase or renewal, requiring existing users to review retirement plans.

The SOAP API login() call in legacy API versions 31.0 through 64.0 will be retired and unsupported in Summer '27.

Sharing recalculations after large group or role updates are now asynchronous, which may break custom logic relying on immediate synchronous updates.

Non-public internal system fields are filtered out from custom object data returned in Aura action responses to align with public API standards.

Turn on profile filtering by default and address changes in sharing recalculation behavior.

A release update prevents anonymous Apex code execution coming from managed packages.

Packaged and distributed connected apps should be migrated to packaged external client apps to reduce security risks.

Retires password and OAuth 2.0 authentication for the Salesforce Connect cross-org adapter in Spring '27, requiring external data sources to migrate to named credentials.

B2B stores created before Summer '25 that use Place Order orchestration are excluded from the background Order Ingestion job until updated.

Salesforce to Salesforce will be retired in Spring '27. Organizations must migrate integrations to modern alternatives like Partner Cloud or MuleSoft.