Prepare for security enhancements with MFA and email domain verification. Find and recover backup data with more control. And discover sensitive data across your org with Data Detect in Salesforce Shield.
- Security Enhancements
Prepare for new and upcoming security enhancements, and review new features that support multi-factor authentication and email domain verification. - Backup and Recover Next
Find and recover backup data with more control. Search backup history for specific records, download metadata for use with your deployment tools, and reload child objects that fail when previewing a restore. These updates help you locate the data you need and address incomplete results without restarting your work. - Domains
Redirections end in sandboxes for instanced URLs in API traffic. And if a third party serves your custom domain, update the target host name. - Identity and Access Management
Replace your connected apps with external client apps. - Named Credentials
Named credentials now support custom CA certificates. - Salesforce Health Insights
Salesforce Health Insights checks your org against Salesforce standards and ranks recommendations for Product Adoption and Implementation Health, all in one view inside your org. Ask the built-in Health Insights Agent about any finding to get a step-by-step remediation plan. - Security Health Review
Security Health Review evaluates your org against Salesforce security best practices and provides on-demand security posture reports with remediation guidance. - Security Center Essentials
Security Center Essentials offers seven new Permissions metrics and a Response Log that lets you track automated threat containment actions taken to protect your org, all at no additional cost. - Privacy Center
Centralize customer consent across Privacy Center. With Global Consent Manager, store consent in a single, scalable system of record and manage billions of consent interactions across your marketing and data processing activities. - Salesforce Shield
Use Data Detect to scan Data 360 data lake objects (DLOs) and create Data Detect policies with an improved guided flow. Encrypt archived data with Shield Platform Encryption. - Security Center
With Security Center, easily identify sensitive or regulated data across all your objects and assign sensitivity levels, compliance categories, and data ownership with Field Classification. Track automated security responses on the Response Log. With Security Mesh, seamlessly bring together internal and external security data into an OCSF-compliant format. Track Model Context Protocol (MCP) servers across connected tenants to monitor risk scores and audit setup activity. Use the External Client Apps metric to monitor authentication settings, security policies, and usage data across connected tenants. - Other Security Changes
Add chrome extensions as a trusted URL/URI to secure your Experience Cloud site. Manage your own root certificates instead of relying on a shared global trust store.
Security, Identity, and Privacy Release Note Changes by Month
We made these additions and changes to published release notes.
October 2026
- Identity and Access ManagementMonitor App Security Controls on the Insights Page(Added the week of October 26, 2026)
- Identity and Access ManagementRefresh Token Idle TTL Is Limited to 30 Days(Updated the
week of October 19, 2026)
- Clarified that access tokens are revoked only if they have been in use for longer than 30 days.
- Security Enhancements: Security Enhancements May Require API
Reauthentication (Updated the week of October 19, 2026)
- Clarified when automated security actions take place and how to resume after session termination.
- Other Changes: Improve Page Load Performance on Custom Pages (Added the week of October 12, 2026)
- Security Center Essentials: Track Automated Security Responses in Security Center Essentials (Added the week of October 12, 2026)
- Security Center: Track Automated Security Responses in Security Center (Added the week of October 12, 2026)
- Security Enhancements: Security Enhancements May Require API Reauthentication (Added the week of October 5, 2026)
September 2026
- Security Center Essentials: Get Permissions Metrics in Security Center Essentials (Added the week of September 7, 2026)
- Security Center: Classify Fields by Sensitivity and Other Key Attributes in Security Center (Added the week of September 7, 2026)
- Security Center: Unify Security Data and View Insights with Security Mesh (Added the week of September 7, 2026)
- Security Center: Monitor MCP Server Configurations in Security Center (Beta) (Added the week of September 7, 2026)
- Security Center: Monitor External Client App Configurations in Security Center (Added the week of September 7, 2026)
- Privacy Center: Manage Consent at Scale with Global Consent Manager (Added the week of September 7, 2026)
- Identity and Access Management: Migrate Packaged and Distributed Connected Apps to External Client Apps. (Removed the week of September 7, 2026)
- Identity and Access Management: OAuth User-Agent and Hybrid User-Agent Flows Are Blocked in New Orgs (Added the week of September 14, 2026)
- Identity and Access Management: OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update) (Updated the week
of September 14, 2026)
- Updated to add a note stating that Salesforce blocks these flows in new Winter ’27 orgs.
- Identity and Access Management: Refresh Token Idle TTL Is Limited to 30 Days (Added the week of September 21, 2026)
- Shield Platform Encryption: Encrypt Archive App Data with Shield Platform Encryption (Added the week of September 21, 2026)
- Security Center: Track Automated Security Responses in Security Center (Removed the week of September 21, 2026)
-
-
- This feature isn't quite ready yet, so we removed it for now.
-
- Security Center Essentials: Track Automated Security Responses in Security Center Essentials (Removed the week of September 21, 2026)
-
-
- This feature isn't quite ready yet, so we removed it for now.
-
August 2026
- Prefix: Create a Messaging Channel with a Headless Claude Skill (Added the week of August 31, 2026)
- Prefix: Security Enhancements May Require Users to Reset Passwords (Added the week of August 31, 2026)