---
schema_version: "1"
id: 12d505ec308afaf60128abbd0788e1088aeb0da2979a054d6e2db5c017e9eb3f
title: Review and Comply with Upcoming Security Requirements
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_enhancements_upcoming.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements_upcoming.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d881a794fc87f8b00bb1b97cf21623ccae4d296dd87fc0c7efc78b5da38485df
description: To protect against evolving cybersecurity threats, Salesforce regularly strengthens security controls. Review new requirements for access controls, email verification, and connected apps and external client apps that access Salesforce data via OAuth (Open Authorization) flows.
products:
  - Cross Cloud
release: "264"
---
# Review and Comply with Upcoming Security Requirements

To protect against evolving cybersecurity threats, Salesforce regularly strengthens security controls. Review new requirements for access controls, email verification, and connected apps and external client apps that access Salesforce data via OAuth (Open Authorization) flows.

**Where:** This change applies to Lightning Experience, Salesforce Classic, and all versions of the Salesforce mobile app. Review each linked release note for scope and edition details. Security requirements for Marketing Cloud Engagement differ. See [Review New and Upcoming Security Requirements for Marketing Cloud Engagement](https://help.salesforce.com/s/articleView?id=release-notes.rn_mce_upcoming_security_requirements.htm&release=264.0.0&type=5 "To protect against evolving security threats, Salesforce updates security requirements. Review the newest authentication and login requirements for Marking Cloud Engagement accounts.").

**When:** These changes are enforced starting in November 2026. Review each linked release note for specific enforcement dates.

**Why:** These release updates improve access controls.

- [Block Apex Anonymous Code Execution from Managed Packages (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_apex_block_exec_anon_ru.htm&release=264.0.0&type=5 "To strengthen subscriber org security, block managed package session IDs from authenticating anonymous Apex code. If you enable this update, installed managed packages can no longer use UserInfo.getSessionId() to obtain a session ID and then use the session ID to execute anonymous Apex.")
- [Enable Profile Filtering (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_permissions_profile_filtering_enforced.htm&release=264.0.0&type=5 "To improve the security of your Salesforce org, the Profile Filtering setting is enabled by default. Profile filtering prevents users from viewing profile names other than their own unless they’re assigned the View All Profiles permission. If a user’s role requires them to see all profile names, assign them the View All Profiles permission before this release update is enforced. This update was first available in Summer ’26 and is enforced in Winter ’27.")
- [Remove Non-Public Fields from Custom Object Data in Aura Action Responses (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_lc_rus_remove_nonpublic_fields_ru.htm&release=264.0.0&type=5 "To improve security, Salesforce is removing non-public system fields from custom object data returned in Aura action responses. This update filters out internal system fields that aren’t part of the public Salesforce API. Review your Lightning components that process custom object data to avoid JavaScript errors or missing data. Use only API-supported fields in your components to ensure that your data displays correctly. This update was first available in Summer ’26 and is enforced in Spring ’27")
- [Update Apex Code and Flows for Changed Sharing Recalculation Behavior (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_sharing_apex_recalc.htm&release=264.0.0&type=5 "To optimize performance after large-scale updates to groups or roles, Salesforce now performs some sharing recalculations asynchronously. If Apex code and flows require that share records be updated immediately, the code and flows can break when this release update is enforced. Update Apex classes, tests, triggers, and flows that update group membership or roles if they rely on synchronous sharing recalculation. This update was first available in Spring ’26.")
- If you use [Aura, LWR, or Visualforce sites](https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&type=5&language=en_US), also see [Conceal Personal Information Fields from Guest Users (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_experiences_conceal_pii_guests.htm&release=264.0.0&type=5 "Set field visibility for guest users without affecting your settings for other external users. Turn on Independent Guest Field Masking to hide certain fields specifically from guest users. This update adds a new Guest_PersonalInfo_EPIM field set so that you can secure guest-facing fields without changing what portal users see.")

These release updates tighten security for connected apps and external client apps that access Salesforce data via OAuth (Open Authorization) flows.

- [Migrate All Connected Apps to External Client Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_migrate_all_connected_apps.htm&release=264.0.0&type=5 "Keep your integrations supported by migrating to external client apps. In Summer '27, Salesforce is ending support for connected apps. Connected apps will keep working, but Salesforce will no longer fix bugs or provide support for the integrations and authorization flows that use them. This update is available starting in Winter ’27 and is enforced for production instances in Summer ’27.")
- [Restrict the OAuth 2.0 Device Flow to Local External Client Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_device.htm&release=264.0.0&type=5 "To secure the OAuth 2.0 device flow, Salesforce is restricting this flow to local external client apps with a localhost callback URL. To prepare for this change, review your usage of the device flow and update your connected apps and external client apps to meet the new criteria. For connected apps, you must migrate to external client apps to continue using the device flow. This update is available in late Summer ’26 and is enforced on November 30, 2026.")
- [Retirement of OAuth 2.0 Username-Password Flow for Connected Apps (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_unpw.htm&release=264.0.0&type=5 "When this release update is enforced, we'll stop supporting the OAuth 2.0 username-password flow for connected apps. This update will break all connected app integrations that use this flow. For better security, update your integrations to use the OAuth 2.0 web-server flow or the OAuth 2.0 client credentials flow instead. This update was first available in Spring ’26 and was scheduled to be enforced in Winter ’27, but we postponed the enforcement date to February 20, 2027.")
- [Salesforce Connect Cross-Org Adapter Legacy Authentication Is Being Retired (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_sf_connect_xorg_legacy_auth_retiring_ru.htm&release=264.0.0&type=5 "The password and OAuth 2.0 authentication methods for the Salesforce Connect cross-org adapter are being retired. These authentication methods rely on the SOAP login() call, which is being retired. The cross-org adapter now supports named credentials for authentication. Migrate any cross-org adapter external data sources to use named credentials, a more robust and secure authentication method.")
- [OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_oauth_useragent.htm&release=264.0.0&type=5 "Salesforce is retiring the OAuth user-agent flow and the OAuth hybrid user-agent flow. For better security, update your integrations to use the OAuth web-server flow or hybrid web-server flow with the Proof Key for Code Exchange (PKCE) extension. This update was first available in late Summer ’26 and is enforced on February 20, 2027.")

These changes improve the security of email sent from Salesforce.

- If you previously disabled user email verification through Salesforce Customer Support, see [Maintain Your Email Verification Exception (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_sales_email_maintain_verfication_exception.htm&release=264.0.0&type=5 "If you previously disabled user email verifications through Salesforce Customer Support, configure an authorized email domain setting to maintain your exception and to preserve your users' ability to send email. When this release update is enforced, Salesforce removes the existing domain allowlists that disable email verification. This update is available starting in Winter '27 and is enforced on December 1, 2026.").
- If you own a Trialforce org, see [Verify Email-Sending Domains to Create New Templates and Trialforce Source Orgs](https://help.salesforce.com/s/articleView?id=release-notes.rn_appexchange_trialforce_identify_domain_verification.htm&release=264.0.0&type=5 "Due to a Salesforce security enhancement for outbound email, you must verify the email-sending domains associated with your Trialforce branded email sets. Starting in Winter ’27, you must verify the email-sending domains in your Trialforce management org (TMO) to create a new associated Trialforce source org (TSO) for a branded email set. This requirement also applies to new templates generated from TSOs associated with your TMO in previous releases. If you’ve already set up a DomainKeys Identified Mail (DKIM) key or an authorized email domain, the associated email sets are automatically verified and you don’t need to take further action.").

**How:** To review the release updates, from [Setup](https://help.salesforce.com/s/articleView?id=xcloud.basics_nav_setup.htm&type=5&language=en_US), in the Quick Find box, enter Release Updates, and then select **Release Updates**. For each release update, follow the testing and activation steps.

For other changes, see the linked release note for details.

#### See Also

- [Explore Features That Support MFA and Email Security](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enhancements_supporting_mfa_email.htm&release=264.0.0&type=5 "As security threats shift quickly, Salesforce develops features to help you meet the latest requirements. Review new features that support multi-factor authentication (MFA) and email domain verification.")
- [Release Updates](https://help.salesforce.com/s/articleView?id=release-notes.rn_ru.htm&release=264.0.0&type=5 "Salesforce periodically provides release updates that improve the performance, logic, security, and usability of our products. The Release Updates page provides a list of updates that can be necessary for your organization to enable. Some release updates affect existing customizations.")