--- schema_version: "1" id: 0dcc8bf0b37a721727a541ca811deee8e8bd39cd25dba57e43ca589b968c262a title: Security, Identity, and Privacy collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security.md canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 0c91cd7d31c43a8e18a8409de1a68a53686933a198cf378e6034fd81084010c1 description: Prepare for security enhancements with MFA and email domain verification. Find and recover backup data with more control. And discover sensitive data across your org with Data Detect in Salesforce Shield. products: - Cross Cloud release: "264" --- # Security, Identity, and Privacy Prepare for security enhancements with MFA and email domain verification. Find and recover backup data with more control. And discover sensitive data across your org with Data Detect in Salesforce Shield. - **[Security Enhancements](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements.htm&release=264.0.0&type=5)** Prepare for new and upcoming security enhancements, and review new features that support multi-factor authentication and email domain verification. - **[Backup and Recover Next](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_bar.htm&release=264.0.0&type=5)** Find and recover backup data with more control. Search backup history for specific records, download metadata for use with your deployment tools, and reload child objects that fail when previewing a restore. These updates help you locate the data you need and address incomplete results without restarting your work. - **[Domains](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_domains.htm&release=264.0.0&type=5)** Redirections end in sandboxes for instanced URLs in API traffic. And if a third party serves your custom domain, update the target host name. - **[Identity and Access Management](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_auth_and_identity.htm&release=264.0.0&type=5)** Replace your connected apps with external client apps. - **[Named Credentials](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_named_credentials.htm&release=264.0.0&type=5)** Named credentials now support custom CA certificates. - **[Salesforce Health Insights](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_health_insights.htm&release=264.0.0&type=5)** Salesforce Health Insights checks your org against Salesforce standards and ranks recommendations for Product Adoption and Implementation Health, all in one view inside your org. Ask the built-in Health Insights Agent about any finding to get a step-by-step remediation plan. - **[Security Health Review](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_health_review.htm&release=264.0.0&type=5)** Security Health Review evaluates your org against Salesforce security best practices and provides on-demand security posture reports with remediation guidance. - **[Security Center Essentials](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center_essentials.htm&release=264.0.0&type=5)** Security Center Essentials offers seven new Permissions metrics and a Response Log that lets you track automated threat containment actions taken to protect your org, all at no additional cost. - **[Privacy Center](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_privacy_center.htm&release=264.0.0&type=5)** Centralize customer consent across Privacy Center. With Global Consent Manager, store consent in a single, scalable system of record and manage billions of consent interactions across your marketing and data processing activities. - **[Salesforce Shield](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_shield.htm&release=264.0.0&type=5)** Use Data Detect to scan Data 360 data lake objects (DLOs) and create Data Detect policies with an improved guided flow. Encrypt archived data with Shield Platform Encryption. - **[Security Center](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center.htm&release=264.0.0&type=5)** With Security Center, easily identify sensitive or regulated data across all your objects and assign sensitivity levels, compliance categories, and data ownership with Field Classification. Track automated security responses on the Response Log. With Security Mesh, seamlessly bring together internal and external security data into an OCSF-compliant format. Track Model Context Protocol (MCP) servers across connected tenants to monitor risk scores and audit setup activity. Use the External Client Apps metric to monitor authentication settings, security policies, and usage data across connected tenants. - **[Other Security Changes](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_other_changes.htm&release=264.0.0&type=5)** Add chrome extensions as a trusted URL/URI to secure your Experience Cloud site. Manage your own root certificates instead of relying on a shared global trust store. ## Security, Identity, and Privacy Release Note Changes by Month We made these additions and changes to published release notes. ### October 2026 - **Identity and Access Management**[Monitor App Security Controls on the Insights Page](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_monitor_app_security.htm&release=264.0.0&type=5 "Review the security controls of the external client apps and connected apps in your org on the Insights page. Verify that your apps are compliant, and manage their security controls. Monitor the status of both enabled and disabled apps whether they are local or developed outside your org.")(Added the week of October 26, 2026) - **Identity and Access Management**[Refresh Token Idle TTL Is Limited to 30 Days](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_refresh_token_ttl.htm&release=264.0.0&type=5 "To protect your data, Salesforce limits how long an idle OAuth refresh token can stay valid. With the enforced idle time-to-live (TTL) setting, refresh tokens expire if they haven’t been used for 30 days. For integrations that don’t use refresh tokens, this control caps the access token lifetime at 30 days from the last login date. At the time of enforcement, Salesforce immediately expires refresh tokens that have been idle for more than 30 days, along with long-running access tokens where the last login date was more than 30 days ago. As a result, users can be logged out and background integrations can be required to request new access tokens. Before Salesforce enforces this change, review how your apps behave when OAuth tokens expire.")(Updated the week of October 19, 2026) - Clarified that access tokens are revoked only if they have been in use for longer than 30 days. - **Security Enhancements**: [Security Enhancements May Require API Reauthentication](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements_require_api_reauthentication.htm&language=en_US) (Updated the week of October 19, 2026) - Clarified when automated security actions take place and how to resume after session termination. - **Other Changes**: [Improve Page Load Performance on Custom Pages](https://help.salesforce.com/s/articleView?id=release-notes.rn_improve_page_load_performance.htm&release=264.0.0&type=5 "Speed up page loads in Chrome on custom pages that reference external scripts by adding the defer attribute to your script tags. Custom pages include those in managed packages, such as Apex pages, Visualforce pages, and Lightning container components.") (Added the week of October 12, 2026) - **Security Center Essentials**: [Track Automated Security Responses in Security Center Essentials](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_center_essentials_response_log.htm&release=264.0.0&type=5 "Salesforce Security automatically takes containment action when it detects a threat, and the Response Log in Security Center Essentials records every completed response in detail. Each entry shows the action type, status, affected entity, and timestamps for the detection and the response. The read-only log helps you quickly distinguish resolved threats from issues that still need attention.") (Added the week of October 12, 2026) - **Security Center**: [Track Automated Security Responses in Security Center](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_center_response_log.htm&release=264.0.0&type=5 "When Salesforce Security detects a threat, it automatically takes containment action on your behalf. The Response Log in Security Center shows each response in detail, including action type, status, target entity, and timestamps for the threat detection and the response. Because the log shows only completed actions, you can quickly distinguish resolved threats from items that still need your attention.") (Added the week of October 12, 2026) - **Security Enhancements**: [Security Enhancements May Require API Reauthentication](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements_require_api_reauthentication.htm&language=en_US) (Added the week of October 5, 2026) ### September 2026 - **Security Center Essentials**: [Get Permissions Metrics in Security Center Essentials](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_center_essentials_permissions_metrics.htm&release=264.0.0&type=5 "Security Center Essentials has several new Permissions metrics. Use them to enhance your organization's security posture and ensure that users have appropriate system access.") (Added the week of September 7, 2026) - **Security Center**: [Classify Fields by Sensitivity and Other Key Attributes in Security Center](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center_classify_fields.htm&release=264.0.0&type=5 "Assign and manage field classifications for fields across all objects in your connected orgs from Security Center. Classify fields individually or in bulk with sensitivity levels, compliance categories, data ownership, and more.") (Added the week of September 7, 2026) - **Security Center**: [Unify Security Data and View Insights with Security Mesh](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center_security_mesh.htm&release=264.0.0&type=5 "Security Mesh simplifies your security operations by unifying security data from internal and external sources into a single format in Security Center. These security findings help you identify and respond to threats more effectively.") (Added the week of September 7, 2026) - **Security Center**: [Monitor MCP Server Configurations in Security Center (Beta)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center_mcp_servers.htm&release=264.0.0&type=5 "Security Center includes an MCP Servers metric for monitoring configured Model Context Protocol (MCP) servers across your organization's connected Salesforce tenants. MCP servers are external integrations that connect Salesforce AI agents to external tools and data sources. Use the metric to check risk scores, detect suspicious server URLs, and audit who configured each server and when.") (Added the week of September 7, 2026) - **Security Center**: [Monitor External Client App Configurations in Security Center](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_security_center_external_client_apps_metric.htm&release=264.0.0&type=5 "Security Center includes an External Client Apps metric for tracking external app configurations across your organization's connected Salesforce tenants. The metric provides detailed visibility into authentication and security policy settings—including authorization dates, granted scopes, and usage data—for each tenant where apps are installed. Alerts notify you when external client apps are added or removed.") (Added the week of September 7, 2026) - **Privacy Center**: [Manage Consent at Scale with Global Consent Manager](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_privacy_global_consent.htm&release=264.0.0&type=5 "Centralize your consent management with a single, scalable system of record. Instead of navigating multiple complex objects to find a customer's privacy preferences, use an attribute-based model to manage billions of consent interactions. Build reusable templates so that data processing activities and marketing campaigns honor the most current customer preferences.") (Added the week of September 7, 2026) - **Identity and Access Management**: Migrate Packaged and Distributed Connected Apps to External Client Apps. (Removed the week of September 7, 2026) - **Identity and Access Management**: [OAuth User-Agent and Hybrid User-Agent Flows Are Blocked in New Orgs](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_flow_blocked.htm&release=264.0.0&type=5 "To support the retirement of the OAuth user-agent and hybrid user-agent flows, Salesforce blocks these flows in new orgs. If you try to use the user-agent flow in a new Winter ’27 org, it fails with an invalid_grant error. For better security, use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension instead.") (Added the week of September 14, 2026) - **Identity and Access Management**: [OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_useragent.htm&release=264.0.0&type=5 "Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension. This update was first available in late Summer ’26 and is enforced on February 20, 2027.") (Updated the week of September 14, 2026) - Updated to add a note stating that Salesforce blocks these flows in new Winter ’27 orgs. - **Identity and Access Management**: [Refresh Token Idle TTL Is Limited to 30 Days](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_refresh_token_ttl.htm&release=264.0.0&type=5 "To protect your data, Salesforce limits how long an idle OAuth refresh token can stay valid. With the enforced idle time-to-live (TTL) setting, refresh tokens expire if they haven’t been used for 30 days. For integrations that don’t use refresh tokens, this control caps the access token lifetime at 30 days from the last login date. At the time of enforcement, Salesforce immediately expires refresh tokens that have been idle for more than 30 days, along with long-running access tokens where the last login date was more than 30 days ago. As a result, users can be logged out and background integrations can be required to request new access tokens. Before Salesforce enforces this change, review how your apps behave when OAuth tokens expire.") (Added the week of September 21, 2026) - **Shield Platform Encryption**: [Encrypt Archive App Data with Shield Platform Encryption](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_pe_archive.htm&release=264.0.0&type=5 "Archived data requires the same protection as your production data. Encrypt sensitive data stored in your archives in a single click with root keys managed in Shield Platform Encryption. You can apply Salesforce-managed keys, bring your own keys (BYOK), or use Shield External Key Management (EKM) to access keys stored in AWS Key Management Service (KMS).") (Added the week of September 21, 2026) - **Security Center:** Track Automated Security Responses in Security Center (Removed the week of September 21, 2026) - - - This feature isn't quite ready yet, so we removed it for now. - **Security Center Essentials:** Track Automated Security Responses in Security Center Essentials (Removed the week of September 21, 2026) - - - This feature isn't quite ready yet, so we removed it for now. ### August 2026 - **Prefix**: [Create a Messaging Channel with a Headless Claude Skill](https://help.salesforce.com/s/articleView?id=release-notes.rn_headless_channel_skill.htm&release=264.0.0&type=5 "Launch a new Facebook, WhatsApp, LINE, or Apple Messages for Business channel in just minutes with a new Claude skill. The service_de_headless_channel_configure skill asks what channel type you need, and proceeds to configure the entire setup across multiple applications, incorporating APIs, and setting up a routing solution. Previously, this level of context-switching in channel setup took over 15 minutes.") (Added the week of August 31, 2026) - **Prefix**: [Security Enhancements May Require Users to Reset Passwords](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_users_reset_passwords.htm&release=264.0.0&type=5 "Because the security of your data is our number one priority, Salesforce is enhancing login security. If we detect a security-related issue with a user’s login information, such as credential stuffing, we revoke all of the affected user’s active sessions and refresh tokens and initiate a forced password reset. In addition, the user receives an automated email with instructions to reset their password.") (Added the week of August 31, 2026)