If you see this release update, your Salesforce instance is using our original single-configuration SAML framework, which supports single sign-on (SSO) with only one identity provider. We’re giving you a final reminder that with Summer ’26, we’re no longer supporting the single-configuration SAML framework. To make sure that your SSO configurations don’t break, migrate to our newer multiple-configuration SAML framework, which supports SSO with multiple identity providers instead of just one. If you don’t migrate, your SAML SSO configurations will stop working when this release update is enforced in Summer ’26.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in Enterprise, Unlimited, and Developer editions.
When: This update is enforced for production instances in Summer ’26 and was enforced for sandboxes in Summer ’24. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.
This update was first made available in Spring ’24. It was scheduled to be enforced for all instances in Summer ’24, but we enforced it only for sandboxes in Summer ’24. We postponed the enforcement date for production instances to Spring ’26 and then postponed it again to Summer ’26.
Why: We’re removing support for the single-configuration SAML SSO framework that you currently use. With this change, all SAML SSO configurations must use our newer multiple-configuration framework. With the multiple-configuration SAML framework, you can integrate your org or Experience Cloud site with multiple external identity providers.
How: If you don’t migrate to the multiple-configuration SAML framework, your SAML SSO configuration will break when this update is enforced.
When you follow the steps to migrate, your current SAML SSO configuration is preserved, but with some key changes:
- Your Salesforce login URL changes. Make sure you have a plan to communicate this change to your users.
- SAML responses from your identity provider must include the
audienceattribute. Work with your identity provider to update SAML responses as needed. - Salesforce generates a new self-signed certificate and uses it to sign SAML requests.
- If Salesforce can’t parse a SAML response, it isn’t recorded in the login history.
Before you migrate your configuration in production, make sure you understand these changes, update your configuration accordingly, and test all changes in a sandbox.
To review this update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Migrate to a Multiple-Configuration SAML Framework, follow the testing and activation steps.