Salesforce deadlines

Security Idle refresh tokens expire after 30 days

Salesforce turns on a 30-day idle limit for refresh tokens on all connected apps and external client apps. At enforcement it revokes existing access tokens and expires refresh tokens idle for more than 30 days, so users may be logged out and integrations must re-authorize.

Before then: Find integrations that run less often than every 30 days and make sure they can re-authenticate cleanly.

Sandboxes from Oct 21, 2026 (rolling); production, scratch and Developer Edition orgs from Nov 4, 2026 (rolling). Source: Refresh Token Idle TTL Is Limited to 30 Days

Release update OAuth device flow restricted to local external client apps

Release update 'Restrict the OAuth 2.0 Device Flow to Local External Client Apps': the device flow only works for local external client apps with a localhost callback URL. Connected apps using the device flow must move to external client apps.

Before then: Inventory device-flow integrations and move them to a local external client app with a localhost callback.

Enforced on a fixed date. Source: Release Updates (Winter '27 release notes)

Release update Email verification allowlists removed

Release update 'Maintain Your Email Verification Exception': if Support previously turned off user email verification for your org, Salesforce removes those domain allowlists unless you configure an authorized email domain setting. It replaces the canceled 'Adopt Authorized Email Domains' update.

Before then: If your org has an email verification exception, configure authorized email domains before December 1.

Enforced on a fixed date. Source: Release Updates (Winter '27 release notes)

Release update SOAP login() requires Use Any API Auth permission

Release update 'Assign Use Any API Auth Permission for SOAP login()': users without the Use Any API Auth permission can no longer authenticate with SOAP API login().

Before then: Assign Use Any API Auth through a permission set to every integration user that still calls SOAP login(), or migrate them to OAuth.

Enforced uniformly across all orgs and environments on this date. Source: Assign Use Any API Auth Permission for SOAP login() (Release Update)

Security SOAP login() hardening in sandboxes

In sandboxes, SOAP login() needs a security token (or mTLS) when the org or profile has a very broad login IP range. SOAP login() is also turned off where it has not been used in the last 6 months.

Before then: Test integrations in sandboxes through the 'SOAP API login() Security Remediation' release update, and append security tokens or narrow IP ranges as needed.

Sandboxes on Dec 15, 2026; production follows on Jan 31, 2027. Source: Platform SOAP API login() Retirement & new Security Requirements (KB 005132110)

Retirement Standard-volume platform events retired

Standard-volume platform events are retired. Setup offers a one-click migration to high-volume platform events.

Before then: Stop publishing, let subscribers finish, then run the migration in Setup > Platform Events before December 15.

Fixed retirement date (extended). Source: Standard Volume Platform Events End of Life

Retirement Data Mask managed package end of support

The managed-package version of Data Mask reaches end of support.

Before then: If your sandboxes use the Data Mask managed package, plan the move to its replacement before year end.

Fixed end-of-support date. Source: Salesforce Active Product & Feature Retirements (KB 000381744)

Release Spring '27 sandbox preview

About 220 sandbox preview instances are scheduled for the Spring '27 upgrade, ahead of production.

Before then: Refresh any sandbox you want on Spring '27 early so it lands on a preview instance, per the Sandbox Preview Guide.

Sandbox preview instances upgrade evening of Jan 8, 2027 Pacific (Jan 9 UTC); dates from the Trust maintenance calendar. Source: Trust Status: Salesforce Services maintenances (Major Release events)

Release update API traffic must use My Domain URL

Release update 'Update Instanced URLs in API Traffic': Salesforce ends support for API traffic sent to an incorrect instanced URL.

Before then: Point every integration at the org's My Domain login URL instead of instance URLs such as na123.salesforce.com.

Enforced in Spring '27 (postponed from Spring '26); date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Retirement Einstein Activity Capture legacy metrics and reports retired

Activity 360 reports, Activity Metrics, the EAC dashboard and Recommended Connections are retired as Einstein Activity Capture moves to storing email as standard activity records.

Before then: Rebuild any reporting that depends on these features using standard Activity reports.

Retired in Spring '27 (February 2027); date is the first Spring '27 production date, exact date varies by instance. Source: EAC Activity Metrics, Dashboard, Recommended Connections and A360 Reports Retirement (KB 005384640)

Security LWS blocks window.open for same-origin URLs

With Lightning Web Security enabled, opening same-origin Salesforce URLs in a new tab with window.open or '_blank' throws a LockerSecurityError.

Before then: Ask developers to replace these calls with a detached programmatic anchor click.

Applies from Spring '27; date is the first Spring '27 production date, exact date varies by instance. Source: Use Programmatic Anchor Clicks for Same-Origin URLs

Release update Non-public fields removed from Aura responses

Release update 'Remove Non-Public Fields from Custom Object Data in Aura Action Responses': internal system fields that are not part of the public API are filtered out of custom object data in Aura responses.

Before then: Test Lightning components that read custom object data and make sure they only use API-supported fields.

Enforced in Spring '27; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release update Personal information fields hidden from guest users

Release update 'Conceal Personal Information Fields from Guest Users' adds a Guest_PersonalInfo_EPIM field set so guest-facing fields can be masked separately from portal users.

Before then: Review which fields guest users on Aura, LWR and Visualforce sites need, and test the update in a sandbox.

Enforced in Spring '27; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release update Platform event triggers roll back on unhandled exceptions

Release update 'Roll Back Platform Event Trigger Transactions on Unhandled Exceptions': when a platform event Apex trigger throws an unhandled exception, partially written records are rolled back instead of committed.

Before then: Check platform event triggers for code that relies on partial commits, and add explicit error handling.

Listed under 'Scheduled to Be Enforced in Spring '27'; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Retirement Salesforce Connect cross-org password and OAuth auth retired

Release update 'Salesforce Connect Cross-Org Adapter Legacy Authentication Is Being Retired': password and OAuth 2.0 authentication for the cross-org adapter stop working.

Before then: Switch cross-org adapter external data sources to named credentials.

Retired in Spring '27; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Retirement Salesforce to Salesforce retired

Release update 'Salesforce to Salesforce Is Being Retired': the Salesforce to Salesforce record-sharing feature stops being supported.

Before then: Migrate to Partner Cloud, Data Cloud One or MuleSoft before your Spring '27 upgrade.

Retired in Spring '27 (retirement list says Feb 2027); date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release update Setup Audit Trail gets its own permission

Release update 'View Setup Audit Trail Permission to Access Setup Audit Trail': access needs the dedicated View Setup Audit Trail permission. Existing access is preserved automatically.

Before then: Assign View Setup Audit Trail to new users who need audit access, and to any integration that reads the audit trail.

Enforced in Spring '27; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release update Some sharing recalculation becomes asynchronous

Release update 'Update Apex Code and Flows for Changed Sharing Recalculation Behavior': after large group or role changes, some sharing recalculation runs asynchronously, so code expecting share records to update immediately can break.

Before then: Review Apex, tests, triggers and flows that change group membership or roles and then rely on share records right away.

Listed under 'Scheduled to Be Enforced in Spring '27'; date is the first Spring '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release Spring '27 production release

Spring '27 production upgrades are scheduled in three waves: January 15, February 5 and February 19-20, 2027 (Pacific).

Before then: Look up your instance on Trust to find which Spring '27 wave applies to your org.

First instances upgrade on this date; the final wave, which most orgs are in, is 19 February 2027. Check your instance on Salesforce Trust. Source: Trust Status: Salesforce Services maintenances (Major Release events)

Retirement Salesforce for Outlook retired

Salesforce for Outlook stops syncing contacts, events and tasks.

Before then: Move users to the Outlook integration and Einstein Activity Capture.

Fixed date, brought forward from December 2027. Source: Salesforce for Outlook Is Being Retired in January 2027

Security SOAP login() hardening in production

In production, SOAP login() needs a security token (or mTLS) for broad IP ranges and is turned off in orgs with no SOAP login() calls in the last 6 months. Rarely run jobs such as annual or DR jobs may look inactive and then fail.

Before then: Check Login History for SOAP logins, confirm rare jobs with their owners, and move them to external client apps with OAuth.

Production date; sandboxes were enforced Dec 15, 2026. Source: Platform SOAP API login() Retirement & new Security Requirements (KB 005132110)

Release update OAuth user-agent and hybrid user-agent flows retired

Release update 'OAuth User-Agent and Hybrid User-Agent Flows Retirement': these flows stop working. New orgs created in Winter '27 already block them.

Before then: Switch affected apps to the web-server or hybrid web-server flow with PKCE.

Enforced on a fixed date. Source: Release Updates (Winter '27 release notes)

Release update OAuth username-password flow retired for connected apps

Release update 'Retirement of OAuth 2.0 Username-Password Flow for Connected Apps': Salesforce stops supporting this flow, which breaks every connected app integration that uses it.

Before then: Move integrations to the OAuth web-server flow or the client credentials flow.

Enforced on a fixed date (postponed from Winter '27). Source: Release Updates (Winter '27 release notes)

Retirement Einstein Relationship Insights retired

Einstein Relationship Insights is retired.

Before then: Tell users who rely on it and remove it from page layouts and permission sets.

Fixed retirement date. Source: Salesforce Active Product & Feature Retirements (KB 000381744)

Retirement Lightning Sync retired

Lightning Sync stops syncing contacts and events with Microsoft and Google.

Before then: Migrate users to Einstein Activity Capture.

Fixed retirement date. Source: Salesforce Active Product & Feature Retirements (KB 000381744)

Release Summer '27 sandbox preview

Sandbox preview instances are scheduled for the Summer '27 upgrade ahead of production.

Before then: Plan sandbox refreshes so a test sandbox is on Summer '27 preview before the SOAP login() and connected app changes land.

Sandbox preview instances upgrade evening of May 7, 2027 Pacific (May 8 UTC); scheduled on Trust. Source: Trust Status: Salesforce Services maintenances (Major Release events)

API API versions 31.0-40.0 deprecated

SOAP, REST and Bulk API versions 31.0 to 40.0 stop receiving security updates and bug fixes in Summer '27, and calls to them will fail after retirement in Summer '28.

Before then: Use API Total Usage event logs to find callers on version 40.0 or older and upgrade them to 41.0 or later.

Deprecated in Summer '27 (no more fixes); calls fail after retirement in Summer '28. Date is the first Summer '27 production date. Source: Salesforce Platform API Versions 31.0 Through 40.0 Are Being Retired

Release update Connected apps reach end of support

Release update 'Migrate All Connected Apps to External Client Apps': connected apps keep working, but Salesforce stops supporting bug fixes, integrations and authorization flows for them.

Before then: Inventory connected apps and migrate them to external client apps, using the automated migration where it fits.

Enforced for production instances in Summer '27; date is the first Summer '27 production date, exact date varies by instance. Source: Migrate All Connected Apps to External Client Apps (Release Update)

API SOAP login() retired in API 31.0-64.0

Release update 'SOAP API login() Call in SOAP API Versions 31.0 Through 64.0 Is Being Retired': login() calls in those versions fail. It is already unavailable in 65.0 and later.

Before then: Move every SOAP login() client to an external client app with OAuth 2.0, and use the release update's test run to simulate the change.

Retired with the Summer '27 upgrade; date is the first Summer '27 production date, exact date varies by instance. Source: SOAP API login() Call in SOAP API Versions 31.0 Through 64.0 Is Being Retired (Release Update)

Release Summer '27 production release

Summer '27 production upgrades are scheduled for May 14, June 4 and June 11-12, 2027 (Pacific).

Before then: Check your instance's Summer '27 wave on Trust; several retirements take effect with this upgrade.

First instances upgrade on this date; the final wave, which most orgs are in, is 11 June 2027. Check your instance on Salesforce Trust. Source: Trust Status: Salesforce Services maintenances (Major Release events)

Retirement Unified Knowledge retired

Unified Knowledge is fully retired in June 2027 after an extension from June 2026.

Before then: Move external knowledge sources to Data 360 unstructured data connectors.

Approximate: month only (June 2027, Summer '27 release); in strict maintenance mode until then. No further extensions. Source: Unified Knowledge Retirement Extended to June 2027 (KB 005101356)

Release Winter '28 sandbox preview

Sandbox preview instances are scheduled for the Winter '28 upgrade.

Before then: Refresh test sandboxes onto a preview instance if you want early access to Winter '28.

Sandbox preview instances upgrade evening of Sept 3, 2027 Pacific (Sept 4 UTC); scheduled on Trust. Source: Trust Status: Salesforce Services maintenances (Major Release events)

Release Winter '28 production release

Winter '28 production upgrades are scheduled for September 17, October 1 and October 8-9, 2027 (Pacific).

Before then: Check your instance's Winter '28 wave on Trust.

First instances upgrade on this date; the final wave, which most orgs are in, is 8 October 2027. Check your instance on Salesforce Trust. Source: Trust Status: Salesforce Services maintenances (Major Release events)

Retirement Marketing Cloud Engagement User Domain retired

Marketing Cloud Engagement's User Domain feature retired on October 4, 2026.

Before then: If you use Marketing Cloud Engagement, confirm login restrictions no longer depend on User Domain.

Fixed retirement date. Source: Salesforce Active Product & Feature Retirements (KB 000381744)

Release Winter '27 production release

Winter '27 began rolling out to production instances in three weekend waves: September 4, October 2 and October 9, 2026.

Before then: Check your instance on the Trust maintenance calendar to see which wave it was in.

First instances upgrade on this date; the final wave, which most orgs are in, is 9 October 2026. Check your instance on Salesforce Trust. Source: Admin Release Countdown: Get Ready for Winter '27

Security User-agent flows blocked in new Winter '27 orgs

New orgs created in Winter '27, including scratch orgs and new sandboxes, reject the user-agent and hybrid user-agent flows with invalid_grant. Sandboxes refreshed from an existing org keep working until the retirement date.

Before then: Use web-server flow with PKCE in any new org or scratch-org-based CI setup.

Enforced in Winter '27 for newly created orgs; date is the first Winter '27 production date, exact date varies by instance. Source: OAuth User-Agent and Hybrid User-Agent Flows Are Blocked in New Orgs

Release update Profile filtering on by default

Release update 'Enable Profile Filtering': users can only see their own profile name unless they have the View All Profiles permission.

Before then: Grant View All Profiles to anyone who needs to see all profile names, such as delegated admins.

Enforced in Winter '27; date is the first Winter '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Release update Accessibility zoom release updates enforced

Three release updates are enforced: 'Enable Accessibility Enhancements for Page Headers and Modal Windows When Zoom Is Greater Than 200%', '...for Date Pickers, Popovers, Bottom Utility Bars, Record Headers', and '...for Cards, Docked Containers, Menu Lists, and Panels'. Lightning layouts reflow at high zoom.

Before then: Spot-check custom Lightning pages and components at over 200% browser zoom.

Enforced in Winter '27 (two were postponed from Summer '26); date is the first Winter '27 production date, exact date varies by instance. Source: Release Updates (Winter '27 release notes)

Security Email becomes default login on login.salesforce.com

The login.salesforce.com and test.salesforce.com UI now shows email-based login as the primary option. Username and password login is still available, and My Domain login pages are not affected.

Before then: Tell users about the new login screen, and point them to your My Domain URL if you use SSO.

Approximate: month only; rolls out gradually starting September 2026. Source: Prepare for Email to Become the Default Login Experience

Release Winter '27 sandbox preview

Sandboxes on preview instances were upgraded to Winter '27 ahead of production so admins could test against their own customizations.

Before then: Use the Sandbox Preview Guide to confirm whether your sandbox was on a preview instance.

Sandbox preview begins; sandboxes on preview instances upgrade first (refresh cutoff was Aug 27, 5 p.m. PT). Source: Admin Release Countdown: Get Ready for Winter '27

Security Phishing-resistant MFA for admins and privileged users

Users with the System Administrator profile or privileged permissions such as Modify All Data, View All Data, Customize Application or Author Apex must use phishing-resistant MFA (for example passkeys or security keys).

Before then: Register passkeys or security keys for every admin and privileged user, including break-glass accounts.

Production rollout by release group July 20 to Sept 3, 2026; sandboxes from July 10, 2026. Source: Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins (KB 005321563)

Security MFA enforced for all employee users

Salesforce began enforcing MFA, with a prompt to create a passkey, for internal users without admin-level permissions, including internal users logging in to Experience Cloud sites. Rollout finished for most orgs by September 3, 2026.

Before then: Make sure every internal user has a registered MFA method and that SSO users get MFA from your identity provider.

Production rollout by release group July 20 to Sept 3, 2026; sandboxes from July 10, 2026. Source: Prepare for MFA Enforcement for All Employee Users (KB 005321561)