Salesforce Winter ’27 Update: 7 Changes That Could Affect Your Business

The Salesforce Winter ’27 update is the platform’s autumn 2026 release. It finished rolling out to production orgs on 9 October 2026. Alongside useful Flow, reporting and AI features, it brings security changes with fixed deadlines, mainly to logins, integrations and email. Most businesses won’t notice a thing. Some will find an integration or automation quietly stops.

Salesforce releases three updates a year, and you can’t postpone them. That’s mostly good news: you get new features without an upgrade project. But each release also includes changes that need testing or a quick configuration review. Winter ’27 has more of those than usual, because Salesforce is tightening security across the board.

Below are the seven areas we’d look at first. For each one we cover what’s changing, why it matters, who’s affected and what to check. We’ve kept confirmed Salesforce changes separate from things that depend on how your org is set up.

1. What security and authentication changes come with Winter ’27?

• What’s changing: Salesforce’s Winter ’27 architect highlights describe a higher “security floor”. Among the Release Updates enforced this release, Profile Filtering stands out: so most users can only see their own profile name. A new permission, Use Any API Auth, is needed for SOAP API logins from 1 December 2026.
• Why it matters: these switch on automatically. Anything relying on the old behaviour can fail without warning.
• Who might be affected: orgs with Flows or reports that read other users’ profiles, and anyone using older integration tools.
• What to check: open Setup, then Release Updates, and work through anything marked Needs Action or Due Soon. Test as a normal user, not an admin, because admins bypass Profile Filtering.

2. Could Winter ’27 affect my integrations?

• What’s changing: from 4 November 2026, refresh tokens left unused for 30 days expire in production. The OAuth username-password, user-agent and hybrid flows retire on 20 February 2027, and connected apps reach end of support in Summer ’27, with external client apps replacing them.
• Why it matters: an integration that can’t log in stops syncing. Leads, invoices or marketing lists go stale, often without an obvious error.
• Who might be affected: anyone connecting Salesforce to accounting, marketing, telephony or website forms, especially older or custom-built connections.
• What to check: list every integration, how it logs in and how often it runs. Monthly or quarterly jobs are the ones most at risk from the 30-day rule.

We cover this in much more detail in our follow-up: could Salesforce Winter ’27 break your integrations?

3. Do I need to test my Salesforce Flows after Winter ’27?

• What’s changing: Flow Builder gets a Test Mode in beta, save-time warnings for missing required fields and over-length text, an edit history panel and screen flows that can run against several selected records.
• Why it matters: the new tools are welcome, but the platform changes around them (permissions, profile visibility, integration users) are what can break an existing Flow.
• Who might be affected: any business whose lead routing, approvals or record updates run on Flow, which is most of them since Workflow Rules and Process Builder reached end of support.
• What to check: run your three to five most important journeys end to end in a sandbox, and look at Paused and Failed Flow Interviews in Setup for recent errors. If a Flow has grown unwieldy, our guide on when to move from Flow to Apex may help.

One detail shows why it pays to read past the headlines. Dynamic batch sizing for scheduled flows was widely reported in August, but Salesforce removed it from the release notes before launch because it wasn’t ready.

4. Will my reports and dashboards still be accurate?

• What’s changing: you can preview a record from a Lightning report without leaving it (beta), embed reports and dashboards in newer Experience Cloud sites (beta) and show only matching rows in joined reports (beta, switched on by Support).
• Why it matters: the new features are optional. The risk is the security changes in section 1 altering what a dashboard’s running user can see.
• Who might be affected: teams whose dashboards run as a specific user, or whose reports group or filter by profile.
• What to check: open your top five reports as a standard user and compare totals with last month. Make sure scheduled report emails still arrive.

5. What should I check in my email settings?

• What’s changing: Salesforce now won’t deliver email from unverified domains, even if the address itself is verified. That came in earlier in 2026. In Winter ’27, the old option to have Support switch off email change verification ends on 1 December 2026.
• Why it matters: quotes, case replies and web-to-lead responses can stop reaching customers, and users rarely see an error.
• Who might be affected: anyone sending from their own domain through Salesforce, particularly from subdomains such as mail.yourcompany.co.uk.
• What to check: in Setup, confirm each sending domain and subdomain has an active DKIM key or an authorised email domain, then send test emails to an outside inbox.

6. What everyday improvements are worth switching on?

Not everything in Winter ’27 needs a risk review. A few changes save time straight away:

• List views: inline editing now works across multiple record types, and an optional setting lets users edit any field they have access to, even if it’s not on the page layout (SF Ben).
• User audit trail: field history tracking on the User object is generally available, tracking up to 20 fields such as profile and role changes.
• Flow Tags: group and find flows more easily as the list grows.
• Setup with Agentforce: admins can use plain-language requests for more Setup tasks, and the Org Health and Usage dashboard can be customised.

7. Is Agentforce in Winter ’27 useful for smaller businesses?

• What’s changing: Agentforce Coworker is included in Starter and Pro Suites, answering questions about your data, drafting follow-ups and keeping records current. For larger editions, Winter ’27 adds an Agent Optimizer in Agentforce Builder and support for working with third-party agents.
• Why it matters: smaller teams on the Suites get practical AI with no extra licence. More autonomous agents on Enterprise edition and above usually mean extra spend on credits and set-up time.
• Who might be affected: SMEs weighing up AI, and anyone with Agentforce already live.
• What to check: start with one well-defined job, such as summarising accounts before calls, and only scale once it works. Our Agentforce implementation guide walks through it.

What about known issues?

Every release has a few bugs, and Salesforce lists them on its Known Issues site. For example, custom buttons in the Dynamic Highlights Panel disappeared from Person Account pages after the upgrade, and Salesforce has since deployed a fix. On the Trailblazer Community, admins also reported beta features not appearing in upgraded sandboxes. If something looks wrong after the release, check Known Issues before spending hours troubleshooting.

Take a proactive approach

Most Salesforce problems after a release aren’t dramatic. A sync stops, a dashboard drifts or an email never arrives, and someone notices weeks later. The fix is a short, regular review rather than waiting for something to break.

That’s exactly what our free Salesforce health check is for. We review security, integrations, automations and data, then give you a prioritised list. If you’d rather someone kept an eye on every release for you, our Complete Care managed service covers release testing as standard. Not sure which you need? Talk to our Salesforce team.

Frequently asked questions

When was the Salesforce Winter ’27 release?

Winter ’27 rolled out to production orgs in stages and finished on 9 October 2026. Your exact date depends on your instance, which you can check on Salesforce Trust under Maintenance.

Can I delay the Salesforce Winter ’27 update?

No. Salesforce upgrades every org automatically. You can test earlier in a preview sandbox, and some Release Updates can be tested before they’re enforced, but you can’t postpone the release.

Will Winter ’27 break my Salesforce integrations?

Most integrations will be fine. Those using older OAuth flows, SOAP API logins or tokens that sit unused for 30 days are at risk. Check how each integration logs in and how often it runs.

What is Profile Filtering in Salesforce?

Profile Filtering stops users seeing other users’ profile names unless they have View All Profiles or certain admin permissions. Winter ’27 enforces it, so test any Flow or report that reads another user’s profile.

Do I need to do anything for Winter ’27?

Review your Release Updates, list your integrations, test key Flows and check your email domains. Our free 15-point checklist covers each step in plain English.