Salesforce Winter ’27 Security Enforcements: How to Prepare Your Org

Salesforce has four security enforcements scheduled for September, and every one of them can break something that works in your org today.

Tom Bassett, Senior Solution Architect at Vera Solutions and a Salesforce MVP, joined Matt Meyers, CTA, CoFounder and CEO of EzProtect, to work through what each change does and how to find your exposure before it lands.

• The OAuth username and password flow retires for connected apps, and any integration still using it stops working.
• Profile filtering becomes the default, so formula fields, validation rules, flows, sharing rules, Apex, and Lightning Web Components that read a profile name can break.
• Salesforce Support loses the ability to disable email change verification, which means you verify the domain yourself with a DKIM key or an authorized email domain.
• Instanced URLs stop being redirected, so an integration calling na45.salesforce.com instead of your My Domain will fail.

Most of that exposure surfaces in one place. Your login history shows which integrations use the username and password flow and which ones call an instance URL, though it only retains six months, so anything running quarterly may not appear at all. Pull the export, reconcile it against your connected apps, then enable each change early in a sandbox and test end to end rather than waiting for September to tell you what broke.