Salesforce Winter '27: What's changing in your org?

Winter ‘27 is the October 2026 release of Salesforce. It entered preview sandboxes on August 28th and 29th and arrived in production orgs on the weekends of September 4th and 5th, October 2nd and 3rd, and October 9th and 10th, 2026. Salesforce declared general availability on October 12th. If your company uses Salesforce, your org is already in this version. Nobody asked, nobody approved, nobody clicked. This is how the platform works three times a year, and that's why the release is the IT manager's business, not just the administrator's.

The question that matters is not “what Salesforce launched”, but rather “what changed in my org without me connecting anything, and what will still change with a scheduled date”. Winter '27 has five hard-enforced Release Updates, a list of authentication retirements with deadlines between November 30, 2026 and mid-2027, and a set of features that are only worth anything if someone activates them. This guide separates the three things, with the date of each one, and ends with a 30-day roadmap for those who inherited the release in production.

What is Salesforce Winter ‘27?

Winter '27 is the October 2026 seasonal release of the Salesforce platform, identified internally as version 264. Release notes were published on August 19, 2026, preview sandboxes were updated on August 28 and 29, and production received the release over three weekends ending October 10, with general availability declared by Salesforce on October 12, 2026. The release applies five mandatory Release Updates, announces retirements of authentication flows with dates until Summer '27 and brings new features in Flow, Apex, reports, Sales Cloud, Service Cloud and Agentforce.

Salesforce delivers three releases per year: Spring in February, Summer in June, and Winter in October. Each one goes first through the preview sandboxes, then through the production orgs, on weekends staggered depending on the instance. The exact date of your org is in the Trust Status, in the maintenance tab of your instance, which you find in Configuration, in Company Information.

There is no option to postpone. What exists is a preview window, of around six weeks, in which the company can test the new version in a sandbox before it reaches production. Those who haven't used the window test it now, in production, with the user inside.

Winter ‘27 Calendar

Date	What happened	Source
August 13, 2026	Pre-release org available for registration	Salesforce Ben, Release Calendar
August 19, 2026	Publication of Release Notes	Salesforce Ben and sfupdates.com
August 27, 2026, 6:00 PM PT	Cut for sandbox refresh to enter preview	Salesforce Help, Sandbox Preview Instructions
August 28 and 29, 2026	Updated preview sandboxes for Winter ‘27	Salesforce Help, Sandbox Preview Instructions
September 4th and 5th, 2026	First weekend of production	Salesforce Admins Blog, Release Countdown
October 2 and 3, 2026	Second weekend of production	Salesforce Admins Blog, Release Countdown
October 9th and 10th, 2026	Third weekend of production, instances not preview	Salesforce Help, Sandbox Preview Instructions
October 12, 2026	Salesforce Declared General Availability	Salesforce Newsroom, Top Innovations in the Winter ‘27 Release
November 30, 2026	OAuth 2.0 Device Flow restriction comes into effect	Release Notes, Release Updates
December 1, 2026	Use Any API Auth mandatory for SOAP login() in all orgs and sandboxes; end of email verification exceptions	Release Notes, Release Updates
February 20, 2027	Retirement of OAuth Username-Password Flow and User-Agent Flows	Release Notes, Release Updates
Spring ‘27 (February 2027)	Retirement of Salesforce to Salesforce, My Domain URL requirement in API traffic, dedicated permission for Setup Audit Trail	Release Notes, Release Updates
Summer ‘27 (June 2027)	End of support for Connected Apps; SOAP login() in versions 31.0 to 64.0 no longer exists	Release Notes, Release Updates

The table says something that the release announcement doesn't: Winter '27 doesn't end on October 10th. It opens a sequence of deadlines that runs until June 2027, and almost all of them touch on integration and authentication. Who centralizes these integrations in the MuleSoft has just one place to check the impact of each deadline.

What has changed in your org without anyone paying attention

Release Update is the name that Salesforce gives to a change in platform behavior that is announced in a release, becomes optional for a while (with a Test Run button in Configuration) and is then imposed on all orgs. The Winter '27 Release Notes list five of them as “enforced with this release”. If no one has tested it before, they have been active in production since the update weekend.

Profile Filtering active by default

With Profile Filtering, the user only sees the name of their own profile. To see others, you need View All Profiles permission. Salesforce did this for security, and the change seems small until one remembers how many customizations use another user's profile name: validation rules with $Profile.Name are safe, because they talk about the current user, but formulas, Flows, assignment rules, approval processes, Apex classes and components that query Owner.Profile.Name or a third party's profile will fail for those who do not have permission.

What to check now: scan Flows, validation rules, formulas, Apex, Lightning components, reports and dashboards looking for references to profile names that are not those of the current user. Where it exists, refactor the logic (public group, permission set or own field) or, as a last resort, grant View All Profiles to those who need it.

SOAP login() requires Use Any API Auth permission

All authentication by operation login() SOAP API now requires the Use Any API Auth user permission. Those who don't have it receive an error. According to the release note, from December 1, 2026, the requirement applies uniformly across all orgs and environments, production and sandboxes included.

In practice, this affects old integrations: Data Loader configured with username and password, legacy middleware, scripts that still call the SOAP API to open a session. It's almost always an integration user that no one has looked at in years. Check the Login History filtering by application and login type, identify integration users and assign permission by profile or permission set before the nightly job stops.

Three Accessibility Release Updates

The other three are accessibility enhancements to comply with WCAG 2.2 resizing and reflow guidelines: page headers and modal windows; cards, docked containers, menu lists and panels; date pickers, popovers, utility bars and record headers. They change how Lightning Experience behaves when the browser is zoomed above 200%. Two of them were already scheduled for Summer '26 and have been postponed until now.

For most users, nothing changes. For those working at high zoom, and for custom components that were designed without thinking about reflow, content may be cut off or overlapped. Test the most used pages at 200% and 400% zoom and involve the developer if any proprietary components break.

What has a date set between now and June 2027

This is the part of Winter '27 that matters most to the IT manager, because it affects what is outside of Salesforce: the systems that connect to it. The list below comes from the Release Updates page of the Winter '27 Release Notes.

Change	When does it come into effect	Who is hit
OAuth 2.0 Device Flow restricted to local External Client Apps with callback on localhost	November 30, 2026	Connected Apps that use device flow need to migrate to External Client Apps
End of email verification exception granted by support	December 1, 2026	Orgs that mass update user emails without verification; You need to configure an authorized email domain
Use Any API Auth for SOAP login() in all orgs	December 1, 2026	Integrations that authenticate using SOAP
Retirement of OAuth 2.0 Username-Password Flow for Connected Apps	February 20, 2027 (postponed from Winter ‘27)	All integration that sends username and password in the request; migrate to web-server flow or client credentials
Retirement of OAuth User-Agent and Hybrid User-Agent flows	February 20, 2027	Apps that use these flows; migrate to web-server flow with PKCE
Salesforce to Salesforce Retired	Spring ‘27	Companies that exchange records between organizations using this resource; alternatives recommended by Salesforce: Partner Cloud, Data Cloud One, MuleSoft Anypoint or MuleSoft for Flow
Salesforce Connect cross-org adapter legacy authentication retired	Spring ‘27	Cross-org external data sources by password or OAuth; migrate to named credentials
API traffic must use My Domain URL, not instance URL	Spring ‘27 (postponed from Spring ‘26)	Integrations that still point to naXX.salesforce.com
Removed non-public fields from Aura action responses	Spring ‘27	Aura components that depend on internal fields of custom objects
View Setup Audit Trail dedicated permission	Spring ‘27	Who accesses the audit trail without View Setup; current access is preserved
Asynchronous share recalculation	Scheduled for Spring ‘27	Apex and Flows that require updated share in the same transaction
End of support for Connected Apps	Summer ‘27	All integrations in Connected Apps; they continue to work, but without fixes or support; migrate to External Client Apps
SOAP login() in API versions 31.0 to 64.0 no longer exists	Summer ‘27	SOAP integrations in old versions
Anonymous Apex Blocking from Managed Packages	Summer ‘27	Packages that use UserInfo.getSessionId() to run anonymous Apex

Two details prevent incorrect work. First, the “Adopt Authorized Email Domains” Release Update, which was circulated in preparation guides throughout the year, was canceled and replaced by “Maintain Your Email Verification Exception”. Second, the retirement of Username-Password Flow was scheduled for Winter '27 and was postponed until February 20, 2027. A checklist made in July tells the team to chase the wrong deadline. The source is the Release Updates page of the Release Notes, not a blog summary.

The thread that connects almost everything is the migration from Connected Apps to External Client Apps. Salesforce has already said it will end support for Connected Apps in Summer '27. If your org has half a dozen Connected Apps integrations, Winter '27 is the time to take inventory: which OAuth flow each one uses, which API version, which login URL. O Salesforce APIs guide and the article about Salesforce integrations help put together this inventory.

What’s worth activating now: platform, Flow and Apex

Nothing that comes below turns on itself. These are new or expanded features that depend on a decision by the administrator or architect, and that change the cost of maintaining the org.

Flow Builder had the biggest update in years

• Test Mode (beta). A dedicated test mode replaces debug: you choose the input record, run it, save the scenario and rerun it after each change. Scenarios accept assertions (conditions that evaluate the expected result) and show coverage of elements and paths. It is in Configuration, in Process Automation Settings, as Flow Test Mode (Beta), for self-launched and record-triggered Flows. It's beta: activate first in sandbox.
• Mass Screen Flows from list views and related lists. A Quick Action with Screen Flow now receives all selected records. Just create a text collection variable in Flow called ids, available for entry. This eliminates custom components that existed just to process a selection.
• Reactive formulas in conditional visibility. Fields on the same screen can appear or disappear depending on what the user has just typed, without an intermediate screen.
• Errors caught when saving. Flow Builder warns you when a Create Records element does not fill a required field or when a value may exceed the size of the target field. Existing flows are not re-evaluated if a field later becomes mandatory, so this does not replace regression testing.
• Split by Field Value and Split by Date. Two new logic elements that create a path by field value (with automatic naming for picklists) or by date relative to today. They do not retire Decision: they do not accept combining values in the same branch and Split by Date only compares with the current date.
• Maintenance of large Flows. Unused resource filter, grouping of elements with label, edit history panel with version restoration and keyboard shortcuts. Grouping and history are being released gradually.
• User context with permissions applied. Screen Flows and self-launched Flows gain the “User Context: Enforces User Permissions” option. Flow runs with the permissions of whoever runs it and only accesses what that user can. It's worth deciding as a team when this becomes the standard.

And an absence that teaches: the Flow Tags, which appeared in the preview sandboxes as a way of classifying Flows by category, were removed from Winter '27 before production. According to Salesforce Ben, Salesforce reported that the feature is “not ready”. Anyone who tested it in the preview and planned around it needs to test it again in the final version. Preview is preview.

Apex: larger heap limit, and a transition switch

The heap limit for synchronous transactions increased from 6 MB to 10 MB, and that of asynchronous transactions from 12 MB to 25 MB, according to the Release Notes. Heap errors usually only appear in production, with real volume of data, and this is a direct relief for Batch Apex and heavy integrations. For those who develop in the Winter '27 sandbox and still deploy in Summer '26 production, there is the option “Enforce the Summer '26 Apex heap limit” in Apex Settings, which maintains the old limit in the development environment. In Spring '27, the new limit applies to everyone, regardless of this configuration. The method Limits.getLimitHeapSize() confirms your org limit.

Two tool changes for those who write Apex: The Web Console becomes the preferred development environment, and the Developer Console no longer appears by default when the Web Console is active. The Developer Console has not been removed: it can be reactivated in Configuration, in Development, in Web Console. Web Console users need Web Console User and View All Data permissions, and anyone running queries needs Use Any API Client. And the REST API supports latest in place of the version number in the URL, which eliminates switching versions three times a year, with the caveat that integrations that require predictable behavior are still better off with a fixed version.

Permissions, data and list

• Field history in User object, available to everyone, with up to 20 fields tracked. Closes a long-standing audit gap: who changed a user's profile, manager or role, and when. Needs to be enabled in Settings.
• Maintain manual shares when transferring records. New setting, off by default and valid for the entire org. Until now, changing the owner deleted manual shares and generated “lost access” calls.
• Expanded inline editing in list views. Two new options in User Interface Settings allow you to edit fields that are not in the layout and edit records of different types in the same list. Both turned off by default; Check layouts and validation rules before activating.
• Reports. Preview of records within the Lightning report, without leaving the screen (beta), and reports and dashboards embedded in Experience Cloud sites in Lightning Web Runtime (beta).

What the sales and service user will notice

For the CTO, this section serves to anticipate the authorization request that will arrive from the business area.

Sales Cloud. After a call transcribed by Einstein Conversation Insights, Salesforce starts suggesting next steps (send proposal, schedule follow-up, involve another person) in the record itself. The mobile app captures post-meeting voice notes, automatically transcribed and saved alongside the call. And Pipeline Forecasting brings together business risk, methodology scoring, contact insights and activity map in the forecast view. The first two depend on the Einstein Conversation Insights license.

Service Cloud. Attachments sent by the client when opening the case appear as tiles below the description, up to three by default, with a link to the full history. Case comments gain AI-powered writing tools (polish, expand, summarize, refine with instruction). Messaging sessions and voice calls can generate automatic summary when ending and save it in case. The customer receives a configurable message when the chat is redirected due to the agent's connection being lost. Outdated case milestones can be deleted from the timeline, resolving an idea open to the community for almost ten years, and the Case Merge configuration has been consolidated into a single screen (beta).

Marketing. Two new agents in Marketing Cloud Next, Marketing Goals Agent and Marketing Content Agent, and Account Engagement Completion Actions arrive in Flow Builder.

None of this turns on itself, and almost everything exposes data: call transcript, conversation summary, AI-generated text in case commentary. Before enabling, it is worth reviewing the permissions model, as we discussed in Salesforce data governance guide.

Agentforce and the platform direction

In the official announcement on August 31, 2026, Salesforce listed the top ten news for Winter '27, and nine of them are from agents. Those that are most interesting to those who already operate the platform:

• Agent Skills and Plugins. A unique registry of reusable skills across surfaces, with more than 100 skills ready at launch and the possibility of publishing the company's own. Plugins package skills with MCP connectors, hooks and configuration; the first, Salesforce Development, is already on the Claude Code marketplace.
• Third-party agent orchestration. Agentforce now orchestrates agents from AWS, Azure, Google and others through the A2A protocol, or acts as a sub-agent where another orchestrator already exists.
• Agentforce Contact Center in over 30 countries, with voice within the CRM, without third-party contact center integration.
• Adaptive Experiences and Dynamic Plans in Service Rep Assistant: An agent tracks the case in real time and updates the resolution plan as the conversation changes.
• Slack Code, code channels shared between people and agents within Slack; Tableau Knowledge, which generates knowledge graphs to provide governed context to agents; and Informatica Headless, which exposes data management through MCP and within tools such as VS Code.

The official release page completes the list for Agentforce with automatically enabled observability without usage metering, curated memory for agents, and dedicated development tools. On the platform, Salesforce highlights enhanced backup and recovery and discovery of sensitive data.

The context is Dreamforce 2026, in September, where the announcements came out that explain where the release points to: AIforce, a layer that exposes CRM data, rules and permissions to any interface via API, MCP or CLI; Builder Central (beta), to create apps and agents from natural language with built-in testing and deployment controls; the Headless Experience Layer and support for React and Angular in general availability; the Security Mesh, within the Security Center; and risk scores for MCP servers registered with Agentforce, which classify each server as low, medium, or high risk before authorizing the connection. We discuss what this means for those who already operate the platform in the article about Claudeforce and in the user guide Agentforce. Hosted servers, the Agentforce MCP client, and per-interaction billing are detailed in the Agentforce guide. Salesforce MCP.

The reading for the IT manager is straightforward: each release pushes more of the org's surface off the Salesforce screen. This increases the weight of three things that Winter '27 precisely changes: authentication (External Client Apps, end of fragile flows), permissions (Profile Filtering, user context in Flow, history of the User object) and observability.

30-day roadmap for those who inherited the production release

If your org updated on October 10th and no one tested it in the preview, the order below prioritizes what stops the operation before what improves the operation.

Week 1: What might be broken now.

1. Open Configuration, Release Updates, and confirm the five Winter '27 updates as applied.
2. Look for references to another user's profile name in Flows, formulas, validations, Apex and components. Correct or grant View All Profiles where unavoidable.
3. List integration users that authenticate via SOAP and assign Use Any API Auth. The uniform deadline is December 1, 2026, but the error may have been occurring since the update.
4. Run a smoke test: login, record creation, the three most critical automations, the integrations that run every day. See Salesforce Known Issues for your instance.

Week 2: the integrations inventory.

5. Export the Login History for the last six months and match the application with the login type. Check the one that uses Username-Password, User-Agent or Device Flow.
6. List the Connected Apps and decide the migration order for External Client Apps, starting with those that fall on November 30th and February 20th.
7. Check if any integrations still use instance URL instead of My Domain, and if any rely on Salesforce to Salesforce or cross-org adapter with legacy authentication.
8. Ask each managed package vendor if the package was validated in Winter '27.

Week 3: what's worth activating.

9. In sandbox, activate Flow Test Mode (beta) and create scenarios for critical automations. It is the release's highest return investment for those suffering from regression.
10. Evaluate “User Context: Enforces User Permissions” as the default for new Flows.
11. Activate field history on the User object and define the 20 fields that the audit needs.
12. Decide whether to maintain manual shares in the transfer and extended inline editing with the architect.

Week 4: the next cycle.

13. Ensure there is a sandbox in preview instance before the Spring '27 cutoff in January 2027. Without this, the next release will also be tested in production.
14. Record the dates of November 30th, December 1st and February 20th in the internal calendar, with the person responsible.
15. Align with the business area what will be enabled in Sales and Service and in what order.

How WeeNow manages releases for existing Salesforce operations

WeeNow is an official Salesforce partner providing ongoing support and improvements for live orgs. We treat releases as a scheduled routine. Before each preview window, we maintain a preview sandbox for each customer, apply Release Updates in Test Run and run regression checks on critical automations and integrations. When production updates, the customer already knows what changed and what was fixed.

For Winter '27, the work focuses on three deliverables: the inventory of integrations with the authentication flow for each one and the migration plan for External Client Apps within the November, December and February deadlines; review of permissions affected by Profile Filtering and SOAP login(); and the adoption of Flow Test Mode in the automations that generate the most calls. Anyone who needs help choosing a partner can start with our Salesforce consulting checklist. If your org had problems after the update, the Salesforce stopped is the first step.

Winter ‘27 FAQ

When did Winter ‘27 go into production?

On the weekends of September 4th and 5th, October 2nd and 3rd and October 9th and 10th, 2026, depending on the instance. Non-preview instances were updated on October 9 and 10, per Salesforce Help's Sandbox Preview instructions, and Salesforce declared general availability on October 12, 2026. Your org's date is in Trust Status in the maintenance tab.

Is it possible to postpone or refuse the release?

No. The update is applied to all orgs on the instance weekend. What the company controls is early testing, in a sandbox in a preview instance, and the activation of optional features.

What Release Updates were imposed in Winter ‘27?

Five: Enable Profile Filtering; Assign Use Any API Auth Permission for SOAP login(); and three accessibility enhancements for zooming above 200% (headers and modals; cards, docked containers, menu lists and panels; date selectors, popovers, utility bars and record headers).

OAuth Username-Password flow ended in Winter '27?

No. Retirement was scheduled for Winter '27 and has been postponed to February 20, 2027, according to the Release Updates page. Integrations that use this flow will need to migrate to web-server flow or client credentials flow by then.

What happens to Connected Apps?

They continue to work, but Salesforce ends support for them in Summer '27, without bug fixes or support for integrations and authorization flows. The recommended path is to migrate to External Client Apps. Device Flow is now restricted to local External Client Apps on November 30, 2026.

What is Profile Filtering and why does it break customizations?

It is the setting that prevents the user from seeing profile names other than their own, except with the View All Profiles permission. Customizations that query another user's profile, such as Owner.Profile.Name in a formula or in a Flow, they start to fail for those who do not have permission.

Has the Apex heap limit changed?

Yes. Synchronous from 6 MB to 10 MB and asynchronous from 12 MB to 25 MB, automatically activated with the release. In Winter '27 sandboxes there is the option to maintain the old limit to validate code that will still be deployed in Summer '26 production. In Spring '27 the new limit applies to everyone.

Does Flow Test Mode replace debugging?

It combines debugging and testing in one place and allows you to save scenarios with assertions and measure coverage. It is in beta, for self-launched and record-triggered Flows, and needs to be activated in Process Automation Settings. Use in sandbox before taking to production.

Are Flow Tags in Winter ‘27?

No. They appeared in preview sandboxes and were removed before production. The lesson applies to every release: validate in the final version, not just in the preview.

Has the Developer Console been removed?

No. In Winter '27 the Web Console is the preferred environment and the Developer Console no longer appears by default when the Web Console is active. It can be reactivated in Configuration, in Development, in Web Console.

When is Spring ‘27?

Salesforce delivers Spring release in February. The cutoff for the sandbox to enter preview usually falls in January. Secure the preview sandbox before then.

Sources

• Salesforce Help. Salesforce Winter '27 Release Notes, Release Updates (version 264): list of updates imposed in Winter '27, scheduled before Spring '27, for Spring '27 and for Summer '27, and canceled updates.
• Salesforce Help. Enable Profile Filtering (Release Update), Winter ‘27 Release Notes.
• Salesforce Help. Assign Use Any API Auth Permission for SOAP login() (Release Update), Winter ‘27 Release Notes.
• Salesforce Help. Handle Larger Datasets with Increased Apex Heap Limits, Winter ‘27 Release Notes.
• Salesforce Help. Test Flows in a Dedicated Test Mode (Beta), Winter ‘27 Release Notes.
• Salesforce Help. Salesforce Sandbox Preview Instructions (article 000391927): Winter ‘27 preview, cutoff, and production dates.
• Salesforce. Salesforce Winter ‘27 Release (official release page): cloud highlights and frequently asked questions about the release cycle.
• Salesforce Newsroom. Top Innovations in the Winter ‘27 Release: AI Agents Run the Work, August 31, 2026: Top ten new features and general availability on October 12, 2026.
• Salesforce Admins (official blog). Admin Release Countdown: Get Ready for Winter ‘27, August 6, 2026.
• Salesforce (The 360 Blog). The Top 5 Dreamforce Announcements for IT: AIforce, MCP Security, and More, September 22, 2026.
• Salesforce Ben. Salesforce Winter ‘27 Release: Everything You Need to Know Before Go-Live, September 14, 2026; Salesforce Winter ‘27 Is Live: 12 Features to Share With Your Team, October 7, 2026; Salesforce Winter ‘27 Is Live: 10 Features to Share With Your Users, October 5, 2026; Salesforce Winter ‘27 Release Date + Preview Information.
• Apex Hours. Salesforce Winter ‘27: Developer Console Is Now Web Console, September 8, 2026.