Most Winter '27 coverage leads with Agentforce. If you own Salesforce integrations, the more urgent part of this release is quieter: it starts removing password-based authentication, and some of it lands before your next budget cycle.
Winter '27 goes GA on October 12, 2026. Here are the changes that can break a working integration, and a practical test for each. The full list of 15 changes, including Flow and Agentforce updates, is in our Salesforce Winter '27 release guide.
1. SOAP login() now needs an explicit permission
Winter '27 enforces the release update "Assign Use Any API Auth Permission for SOAP login()". Any user that authenticates through the SOAP login() call needs that permission, or the login fails.
Test: list every integration user, find the ones still calling login(), and grant the permission through a permission set rather than a profile. Then run each integration end to end in a preview sandbox.
Why not stop there: the SOAP login() call itself is scheduled to retire on June 1, 2027. Granting the permission buys time. It does not fix the design.
2. The OAuth username-password flow retires on February 20, 2027
This is the one most likely to cause a silent outage. Integrations that request a token with grant_type=password (username, password and security token) will stop getting tokens. There is no error screen for a user to notice, just a nightly job that quietly stops.
New orgs already block this flow by default. Older orgs with middleware built years ago are the ones at risk.
Test: search your integration code and middleware config for grant_type=password. For each hit, pick a replacement:
- Client credentials flow running as a dedicated integration user. The simplest swap for scheduled jobs and middleware.
- JWT bearer flow with a certificate. Better for sensitive integrations because no password is stored anywhere.
Keep secrets in Named Credentials rather than in code or environment files.
3. Standard-volume platform events are on the way out
You can no longer create new standard-volume platform events, and new events are high-volume by default. According to the Platform Events Developer Guide, existing standard-volume events retire in Summer '27.
Test: list your custom platform events and check which are still standard-volume. Migrating is not complicated, but it touches every subscriber: Apex triggers, flows and any external CometD client. Retest all of them after the change.
4. Profile Filtering is on by default
Users without the View All Profiles permission can no longer see the names of profiles they are not assigned to. Any code, flow or report that reads Profile.Name as a standard user may now get nothing back.
Test: search your metadata for Profile.Name, run that logic as a standard user in the sandbox, and consider switching profile-based checks to custom permissions, which survive changes like this.
A simple order of work
- Confirm your production upgrade window on Salesforce Trust status.
- Test in a preview sandbox, not a pre-release org. Pre-release orgs have the features but none of your configuration.
- Work through Setup, then Release Updates, before looking at new features.
- Put the 2027 migrations (OAuth flow, SOAP login, platform events) on the roadmap now, while there is still room before year-end freezes.
Integration changes rarely fail loudly. They fail at 2am on a scheduled job, and someone notices a week later when the numbers do not match. An hour of inventory work now is cheaper than that week.
This article was originally published on the Ashapura Softech blog, which covers all 15 Winter '27 changes worth testing.
Top comments (0)