Salesforce is rolling out a critical security update that impacts how third-party apps, plugins, and custom integrations log into your Salesforce org.
If your organization relies on external software connected to Salesforce, this update requires your attention to prevent potential service disruptions.
Here is a simple breakdown of what is changing, why it matters and how your team can prepare.
What Is Changing?
Salesforce is adopting a stricter “Secure-by-Default” approach to safeguard customer environments. As part of this security push, Salesforce is retiring the legacy SOAP API login() method.
In plain terms:
In the past, older integrations logged into Salesforce by sending a username and password directly. Salesforce is phasing this method out in favor of modern, secure authentication protocols-specifically OAuth 2.0 and External Client Apps.
Key Deadlines & Milestones
- Winter ’27 (October 2026): Salesforce will enforce an interim security control. Any user or integration authenticating via the legacy SOAP method will fail with an error (INSUFFICIENT_ACCESS) unless explicitly granted a new permission called “Use Any API Auth”.
- Summer ’27 (June 2027): The final retirement date. After this point, the old login method will stop working entirely, regardless of permissions.
What Happens If No Action Is Taken?
If affected integrations are not upgraded before the deadlines, they will lose connection to Salesforce.
This can result in:
- Failed data syncs between Salesforce and internal tools (like ERPs or marketing systems).
- Broken automated background jobs.
- Errors in desktop or browser extensions (like Outlook/Gmail add-ins or older versions of Data Loader).
How to Check If Your Business Is Affected
Your Salesforce Administrator or IT team can perform a quick audit inside Salesforce Setup:
- Check Login History: Review recent sign-ins filtered by API Type (such as SOAP Enterprise or SOAP Partner) and Login Type.
- Review Event Logs: Use the Event Log File Browser to spot tools actively using the login() resource.
- Run a Test Simulation: In Sandbox environments, admins can activate the “SOAP API login() Retirement” Release Update test run to safely verify which tools break before it impacts live production.
Need Help Navigating This Update?
Audit processes, authentication protocols and third-party vendor coordination can feel overwhelming when managing a busy Salesforce environment.
As a Salesforce Professional Services Partner, our team is here to help you:
- Run a comprehensive authentication audit across your entire org.
- Identify legacy connections and shadow integrations before they break.
- Plan and execute seamless migrations to modern OAuth 2.0 and External Client Apps.
Reach out to us today for a consultation or security health check to keep your Salesforce environment safe and seamless!