Checked against Salesforce’s published guidance on 11 September 2026. Confirm the dates and updates that apply to your Salesforce environment before making changes.
Salesforce’s Winter ’27 release arrives this autumn. For a smaller business, the useful questions are which changes affect your team, whether anything needs updating and who should handle it.
You might have a dedicated Salesforce administrator, a colleague who looks after it alongside their main role, or a support partner. Whoever takes that responsibility needs a clear starting point.
This guide covers selected Winter ’27 release updates affecting permissions, integrations and Agentforce access, plus the later deadlines worth including in your plans. Start with the processes your business relies on: customer follow-ups, email, reporting and the movement of information between systems.
When does your business get Winter ’27?
Salesforce upgrades production environments over several weekends. Its published Winter ’27 schedule lists these weekend starting dates:
These are the release weekends, rather than an exact appointment for your business. The date and time for your instance are listed in Salesforce Trust. Sandbox preview, which allows testing in a separate environment, began on 28 August. Salesforce’s release calendar
Ask your administrator to find your instance under Setup → Company Information, then check it in Salesforce Trust. If your upgrade has already happened, use the checks below to confirm the affected processes are working. If it is still ahead, build them into your preparation.
In Setup → Release Updates, review the updates shown for your environment and their testing instructions. Use this alongside the release notes and any guidance from your software suppliers. Salesforce’s release-preparation guidance
What to check for Winter ’27
Agentforce is enabled by default for eligible orgs
Salesforce is enabling the Agentforce platform by default for organisations that have access through their edition or licence. The current release note names Lightning Experience in Enterprise, Performance, Unlimited and Developer Editions with Foundations or Agentforce 1; eligibility still depends on the SKU and org setup. New orgs created in Winter ’27 are enabled at creation, and existing orgs are being enabled on a rolling basis from the first week of September 2026. Salesforce plans to remove the on/off setting from Setup → Agentforce Agents later in Winter ’27. Salesforce’s Agentforce release update
That does not mean an agent has been designed or activated for your team. If Einstein generative AI is enabled, administrators have immediate access to Agentforce Builder. Other users need the Manage AI Agents permission, and an individual agent is available to end users only when it is active.
For a smaller business, agree who can build, review and activate an agent before anyone starts configuring one. Also agree which records or actions it may use, and test a useful, contained process first. Salesforce says enabling the platform itself does not add a charge or change billing; check the licence and commercial terms for any specific Agentforce product before you plan wider use.
Agentforce Coworker is a separate rollout
Salesforce is also auto-enabling Agentforce Coworker on a rolling basis for customers with unmetered User-Based AI entitlements. Eligible users may see an Ask button beside Global Search, with answers based on the CRM data they are already allowed to access. Salesforce says the automatic enablement needs no additional setup, training or cost for those eligible seats. Organisations without those entitlements are not included, and administrators can opt out or opt back in from Agentforce Coworker Setup. Salesforce’s Agentforce Coworker guidance
If someone reports that the Ask button has appeared, confirm the entitlement and decide whether it belongs in your normal working practices. Treat this as a separate check from the Agentforce platform setting above.
Integrations using SOAP login()
Some integrations use a method called SOAP login() to sign in to Salesforce. Winter ’27 requires the account making that login to have the Use Any API Auth permission. Without it, the login returns an error. Salesforce’s SOAP permission update
Ask whoever maintains each integration to confirm whether it uses this method and whether its account has the required permission. Where it is needed, your administrator can assign the permission through a permission set and test the connection.
Check a completed transfer as well as a successful login. For example, confirm that the expected records arrived from your finance system. Include less frequent jobs in the review; recent login activity alone will not give you a complete list.
Customisations that use profile information
Salesforce profiles are part of how user access is configured. Profile filtering becomes enforced in Winter ’27, restricting visibility of other users’ profile names. Salesforce’s profile-filtering release update
Users can still see their own profile name. View All Profiles and certain administrative permissions allow wider visibility. Salesforce’s permission guidance
Ask your administrator to identify custom components or automation that access other profiles and test them using the permissions of the people who use them. The result depends on what the customisation accesses and how it runs.
Grant additional access where the role requires it. An administrator’s successful test should be followed by a check with representative user permissions.
Pages used at higher browser zoom
Three accessibility updates are enforced in Winter ’27. They cover page headers and modal windows, date pickers and popovers, and cards, docked containers, menus and related elements at higher magnification. Salesforce’s enforced release updates
Include a check above 200% browser zoom on the pages your team uses most. Confirm that fields, buttons and menus remain usable, particularly where layouts or components have been customised. Include someone who regularly uses those accessibility settings where possible.
Later deadlines to include in your plans
Some related changes have fixed enforcement dates after the production upgrade. These are the later updates covered in this guide; applicability depends on your configuration.
| When | What to check | Who to involve |
|---|---|---|
| 30 November 2026 | Apps using OAuth device flow | The app supplier or integration developer |
| 1 December 2026 | Existing exceptions to user email verification | Your Salesforce administrator or support partner |
| 20 February 2027 | Connected app integrations using OAuth username-password flow | The integration owner and supplier or developer |
| Spring ’27, in phases | API traffic using an incorrect instance URL | The integration owner and supplier or developer |
The detail and Salesforce sources for each entry are below.
30 November: check apps using device flow
OAuth device flow is a particular way an app obtains authorisation to connect. Salesforce is restricting it from 30 November 2026: continued use requires a local External Client App with a localhost callback URL. Connected apps using this flow need to migrate to meet the new requirements. Salesforce’s device-flow update
If you use third-party apps, ask their suppliers whether they use device flow and whether you need to take any action. For an integration built for your business, put the same question to its developer. Agree any necessary update and test it before the deadline.
1 December: review any email-verification exception
This applies where Salesforce Support previously disabled user email verification for one or more domains. Affected environments show Maintain Your Email Verification Exception in Release Updates.
The new process is enforced on 1 December 2026. If the required steps are not completed, affected users with unverified email addresses can lose the ability to send email from Salesforce. Salesforce’s email-verification update
Ask your administrator to check for the update and follow its instructions if it appears. Confirm the affected users can send email afterwards.
If an earlier checklist refers to Adopt Authorized Email Domains, Salesforce has cancelled that update and replaced it with this one. Salesforce’s current release-update list
20 February: plan any username-password flow migration
Salesforce has postponed retirement of the OAuth username-password flow for connected apps to 20 February 2027. Integrations still using it will no longer work once the change is enforced.
The appropriate replacement depends on the application. Salesforce recommends client credentials for server-to-server integrations, and web-server flow with PKCE where a user signs in and authorises access. The supplier or developer should confirm the supported approach. Salesforce’s retirement and migration guidance
Use the time to agree the work and test the result. Identify the owner, check whether the supplier has an update available, and schedule any configuration or development needed. Allow for the business cycle the integration supports, including month-end or quarterly processing.
Spring ’27: check the addresses used by integrations
Update Instanced URLs in API Traffic has moved to Spring ’27, with phased enforcement.
It affects API traffic directed to an incorrect Salesforce instance address. Salesforce recommends using your organisation’s My Domain login URL, which remains consistent when Salesforce moves the environment to another instance. Salesforce’s instanced-URL update
Ask your integration supplier or developer to check the configured addresses and follow the current enforcement schedule. Include the result in the same review as authentication so both dependencies have an owner.
Keep the review proportionate to your business
A useful outcome is a short list of affected processes, owners, actions and dates. Start with the work that matters to your team, then agree the technical checks with the people responsible for Salesforce and its connections.
- Confirm what applies. Review Release Updates and ask suppliers about the apps and integrations they maintain. Record where a check confirms that no change is needed.
- Test the business process. Choose relevant examples, such as assigning a new lead, sending a customer email or completing a scheduled export. Use a sandbox where available and include representative user permissions.
- Give each action an owner and a date. Include supplier involvement and any user communication. For less frequent processes, agree how they will be tested before the deadline.
- Check the result after the change. Confirm that the expected information reaches the right place. Make sure someone receives and follows up on job failures or other exceptions.
The scope will depend on your setup. Some checks may confirm that everything is already in place; others may identify a permission change, a supplier update or development work. Establishing that scope early gives you time to arrange the right help.
Include your Outlook connection in the review
If your business connects Outlook to Salesforce, there is a separate Microsoft Graph transition to check. Our Outlook and Salesforce guide explains the connection types, timing and people involved.
Keeping a record of your connected systems and their owners supports both ongoing Salesforce integration management and reviews of Salesforce security.
Salesforce Winter ’27: frequently asked questions
When will our Salesforce environment receive Winter ’27?
The production release weekends begin on 4 September, 2 October and 9 October 2026. Your exact date and time depend on your instance; check Salesforce Trust. Official release calendar
Does Winter ’27 switch on an Agentforce agent for our users?
For an eligible org, Winter ’27 enables the Agentforce platform. It does not design or activate every agent automatically: administrators get access to Agentforce Builder when Einstein generative AI is enabled, other users need the Manage AI Agents permission, and an individual agent is available to end users only when it is active. Salesforce says the platform enablement itself does not add a charge or change billing. Salesforce’s Agentforce release update
Agentforce Coworker is a separate rollout for customers with unmetered User-Based AI entitlements, so check whether an Ask button has appeared and whether that feature is relevant to your team. Salesforce’s Agentforce Coworker guidance
Do all businesses need to change their integrations?
The required work depends on the authentication methods, apps and addresses your integrations use. Ask the people maintaining them to confirm which updates apply and record the outcome, including where no change is needed.
Does profile filtering mean we should give everyone View All Profiles?
Additional access should follow the requirements of the role. Review the customisations that use profile information, test with the relevant user permissions and grant access where it is needed. Salesforce’s permission guidance
When is the OAuth username-password flow being retired?
The published enforcement date is 20 February 2027. The change affects connected app integrations still using that flow. Ask the supplier or developer to confirm whether a migration is needed. Salesforce’s retirement notice
