Salesforce Winter '27: Release Dates and the Five Updates to Prepare For Now

What Changed Since Our July Version?

We wrote the original version of this article before the release notes existed, working from the Summer '26 notes and the schedule Salesforce had announced. Three things have moved, and we would rather say so than quietly edit:

• The OAuth 2.0 username-password flow retirement is postponed. The release update page now reads: "This update was first available in Spring '26 and was scheduled to be enforced in Winter '27, but we postponed the enforcement date to February 20, 2027." It still breaks every connected-app integration on that flow when it lands, so the audit we recommended in July is still the right work. It just has a later deadline.
• "Adopt Authorized Email Domains" is cancelled. Its page says: "This update has been canceled and replaced by the Maintain Your Email Verification Exception update." The replacement is enforced on 1 December 2026 and only appears in orgs where Salesforce Support once disabled email verification.
• Two accessibility updates that were postponed from Summer '26 now enforce with Winter '27, alongside the one we listed. Low breakage risk, but three of the five enforced updates are now about high-magnification layouts.

The Order Management tax-rate item we listed in July does not appear on the Winter '27 Release Updates page at all, so we have dropped it.

When Does Winter '27 Reach Your Org?

The dates below come from the Salesforce Trust maintenance calendar (queried 8 September 2026) and the official sandbox preview instructions, not from previews or blogs.

Milestone	Date
Release notes published	Week of 17 August 2026
Sandbox preview cutoff	Create or refresh before 6:00 PM PT on 27 August 2026 (13:00 NZST, Friday 28 August)
Preview sandboxes upgraded	28 and 29 August 2026
Non-preview sandboxes upgraded	9 and 10 October 2026
Production windows (UTC)	Saturday 3 October, and Friday 9 to Saturday 10 October 2026
Australian-hosted instances (AUS and AP)	Sunday 11 October 2026, 04:00 to 08:30 NZDT, in 30-minute windows
Your instance	Salesforce Trust, select your instance, then Maintenances

Two notes for New Zealand readers. Daylight saving starts on 27 September, so October windows are UTC plus 13 hours. And if your org lives on a North American instance (common for orgs set up years ago), your window is on 3 October or 9 to 10 October in UTC terms, so check rather than assume.

A calendar quirk we flagged in July still holds: Dreamforce 2026 runs 15 to 17 September, which puts the conference right in the middle of release season. Expect the news cycle to be loud; your org's upgrade date will not care.

Which Release Updates Enforce With Winter '27?

Release updates are not optional features: they enforce automatically on their schedule, and each one appears in Setup under Release Updates with a test run option. From the Winter '27 Release Updates page, the five enforced with this release are:

Release update	What changes	Who should care
Assign Use Any API Auth Permission for SOAP login()	Users without the permission "can no longer authenticate with SOAP API login() and will encounter an error"	Anyone with an integration, data loader or middleware that logs in via SOAP
Enable Profile Filtering	Users see only their own profile name unless assigned View All Profiles	Orgs whose flows, validation rules or reports reference other users' profile names
Accessibility: page headers and modal windows above 200% zoom	Lightning layouts adapt at high magnification (WCAG 2.2 Resize and Reflow)	Teams with users who work zoomed in
Accessibility: date pickers, popovers, utility bars, record headers	Same, for more components; postponed from Summer '26	Same
Accessibility: cards, docked containers, menu lists, panels	Same, for more components; depends on the page-headers update	Same

Two more enforce on calendar dates before the next release: the OAuth 2.0 device flow is restricted to local external client apps from 30 November 2026, and Maintain Your Email Verification Exception enforces on 1 December 2026. Beyond that sit the Spring '27 and Summer '27 items: the username-password and user-agent OAuth flows (20 February 2027), instanced URLs in API traffic, Salesforce to Salesforce, connected apps losing support in Summer '27, and more. We walk through every one of them, with who is affected and what to do, in Salesforce Winter '27 Is Live: What Can Break in Your Org and How to Fix It.

What Are the Two That Can Actually Bite?

Profile Filtering. It is common for validation rules, flows, Apex and report filters to reference profile names: logic like "if the user's profile is Sales Rep, then…" can evaluate differently when the running user cannot see that name. The release note is blunt: "If a user's role requires them to see all profile names, assign them the View All Profiles permission before this release update is enforced." Search your automation for profile-name references and decide, case by case, whether to grant the permission or rebuild the logic on permission sets, which was best practice anyway. Test as a standard user, not as an admin who already holds View All Profiles.

Use Any API Auth for SOAP login(). Old integrations, some data-loading tools and hand-built scripts still authenticate with the SOAP login() call. From Winter '27 the calling user needs the Use Any API Auth permission or the call fails. Inventory your integration users and assign the permission through a permission set. Note that the SOAP login() call itself in API versions 31.0 to 64.0 is scheduled for retirement in Summer '27, so this is a stepping stone, not the destination. Our integrations post covers the whole timeline, including what to move to.

Our Suggested Prep Sequence

1. This week: confirm your instance's window on Salesforce Trust; open Setup, then Release Updates, and note everything pending with its Complete Steps By date.
2. Before your production window: run the profile-name search and the integration-user inventory above. These two are the real work.
3. In an upgraded sandbox: test your critical paths (lead to opportunity, case handling, every integration touchpoint) as a standard user. If you kept a sandbox on Summer '26, it upgrades on 9 or 10 October, so a preview sandbox is the only place to test early.
4. Before 30 November and 1 December: deal with the device-flow and email-verification updates if they appear in your org's Release Updates list. If they do not appear, they do not apply to you.

If nobody in your business has time to own this, that is the gap our managed services fill: release readiness is part of the standing service, from NZ$1,500 a month. For a one-off check, the free health check is a good place to start.

Read the Full Winter '27 Series

We have covered the release in six follow-up posts, each written from the published release notes:

• What can break in your org and how to fix it: every release update and retirement, with dates and fixes
• For admins: Flow Test Mode, list views and the Setup changes worth your time
• For sales teams: Sales Cloud becomes Agentforce Sales, and the two dated actions for every sales org
• For service teams: Agentforce on by default, Knowledge Blocks and case merge
• For your integrations: connected apps, OAuth flows and API retirements
• For nonprofits and schools: Nonprofit Cloud, NPSP and Education Cloud

For context on how we covered the last release, see our Summer '26 admin post.

Frequently Asked Questions

When is the Salesforce Winter '27 release? Preview sandboxes upgraded on 28 and 29 August 2026. Production instances upgrade in windows on 3 October and 9 to 10 October 2026 (UTC); every Australian-hosted instance is scheduled between 04:00 and 08:30 NZDT on Sunday 11 October 2026. Your org's exact window is on Salesforce Trust (status.salesforce.com) under your instance, so check that rather than assuming.

What is a Salesforce release update? A change Salesforce schedules in advance that alters existing org behaviour. Unlike optional new features, release updates enforce automatically on a published date. Each appears in Setup under Release Updates, usually with a test run option and a Complete Steps By date. Five enforce with Winter '27 itself and two more enforce on calendar dates before Christmas 2026.

Will Winter '27 break anything in my org? The two enforced updates with real breakage potential are Profile Filtering (users see only their own profile name unless they hold View All Profiles, which can change what flows, validation rules and reports evaluate) and the Use Any API Auth permission for SOAP login() (integrations and tools that authenticate that way fail without it). The OAuth username-password flow retirement has been postponed to 20 February 2027.

When did the Winter '27 release notes come out? Salesforce first published them during the week of 17 August 2026 and logs later changes on the Release Note Changes page. Everything in this article and in our six follow-up posts is taken from those notes and from the Trust maintenance calendar, not from third-party previews.

How should a small NZ business prepare for a Salesforce release? Four steps: confirm your instance's window on Salesforce Trust; open Setup, then Release Updates, and run the test runs for anything pending; test your critical flows and any integration touchpoints in an upgraded sandbox; and read the release-update pages for the two dated enforcements (30 November and 1 December 2026). An hour of preparation beats a Monday-morning surprise.

---

SAASKOOL keeps orgs release-ready as part of managed services: audits, sandbox testing and the unglamorous update work, handled. Want to know where your org stands today? The health check is free.