Fix Guides
Salesforce Authentication Deadlines: Every Verified Date, What Happens and Who Is Affected
Updated 2026-11-13
What this is: the dated entries on the Salesforce Help roadmap Salesforce Platform Security Requirement Updates (005461718), in one table, with what happens on each date and who is affected. Every date was read from that article on Nov 13, 2026. Sandbox dates come first, production dates later.
Deadline checklist
| Date | What happens | Who is affected | Source |
|---|---|---|---|
| Oct 26, 2026 (Sandbox and Production) | Security enhancements that may require API reauthentication begin. Salesforce moved this date twice: from Oct 9 (Sandbox) and Oct 16 (Production), then to Oct 21, then to Oct 26. | Integrations and API clients that hold existing authorizations and may need to reauthorize. | Roadmap 005461718, Security Enhancements May Require API Reauthentication; release note |
| Nov 9, 2026 (Sandbox) and Nov 13, 2026 (Production) | The new SSO-Required permission becomes available. | Orgs that force users through single sign-on today. Eligibility for the automatic migration needs all three of: “Disable login with Salesforce credentials” on, an empty Delegated Gateway URL, and at least one user with “Is Single Sign-On Enabled”. | Roadmap 005461718, New SSO-Required Permission and Automatic Legacy Configuration Migration |
| Dec 1, 2026 | The Use Any API Auth permission applies to SOAP login(). | Users and integrations that authenticate with the SOAP login() call. | Roadmap 005461718, SOAP API Login() Security Requirements and Summer ’27 Retirement |
| Dec 1, 2026 (Sandbox) and Dec 9, 2026 (Production) | The block on direct login for SSO users who have not registered MFA becomes available. | SSO users who can still log in directly with a Salesforce username and password and have not registered MFA. | Roadmap 005461718, Direct Login Blocked for SSO Users Who Haven't Registered MFA |
| Dec 15, 2026 (Sandbox) and Jan 31, 2027 (Production) | A security token is required on broad IP ranges, and SOAP login() is disabled in inactive orgs. | SOAP login() integrations that rely on broad trusted IP ranges instead of a security token, and orgs with no recent activity. | Roadmap 005461718, SOAP API Login() Security Requirements and Summer ’27 Retirement |
| Jan 7–18, 2027 (Sandbox) and Feb 4–20, 2027 (Production) | Two things are scheduled in this window: eligible legacy SSO configurations are automatically migrated to the SSO-Required permission, and the direct-login block for SSO users who have not registered MFA is enforced. | Orgs that meet the three eligibility conditions above, and SSO users without a registered MFA method. | Roadmap 005461718, both SSO rows |
| Summer ’27 | SOAP login() is fully retired. | Anything still calling SOAP login(). | Roadmap 005461718, SOAP API Login() Security Requirements and Summer ’27 Retirement |
- The same roadmap lists Guest User External and Personal Information Management and Guest User GraphQL Queries as optional in Winter ’27 (all environments) and mandatory in Spring ’27. These concern guest users rather than login, so they are not in the table above.
- Connected app and external client app changes, such as the refresh-token and OAuth flow changes, have their own Salesforce article and are not repeated here.
What to Check
- 1. Find SOAP login() callers. Search Login History for the SOAP API login type and list each user and application. Those are the integrations the Dec 1, Dec 15 and Jan 31 dates reach.
- 2. Check your trusted IP ranges. Note which integration users depend on broad IP ranges to log in without a security token. Per the roadmap, a token is required on broad ranges from Dec 15, 2026 in sandboxes and Jan 31, 2027 in production.
- 3. Check SSO eligibility. In Setup, confirm whether “Disable login with Salesforce credentials” is on, whether the Delegated Gateway URL is empty, and whether any user has “Is Single Sign-On Enabled”. If any of the three is false, the automatic SSO migration does not apply.
- 4. List SSO users without MFA. Find users who sign in through SSO but have not registered an MFA method. They are the users the direct-login block is aimed at.
- 5. Review which integrations reauthorized. After Oct 26, 2026, look for integrations that stopped working or were asked to reauthorize, and reauthorize them.
Related guides: SSO Required sandbox auto-migration, Salesforce certificate changes and Winter ’27: find the integrations that will break.
Check your org's authentication posture free: the free health check is a short questionnaire that gives a peer-benchmarked score, with no account and no org connection.
Sources: Salesforce Help 005461718 (Salesforce Platform Security Requirement Updates); for connected app and external client app changes see 005461287. Read on Nov 13, 2026. Dates can move, so confirm them in the live articles.
FAQ
Where do these dates come from?
From the Salesforce Help roadmap “Salesforce Platform Security Requirement Updates” (article 005461718), which Salesforce describes as the ongoing roadmap for critical product changes affecting core platform security. We re-read it in a browser on Nov 13, 2026; its publish date is Nov 10, 2026. Dates can move, so confirm them in the live article.
Did the SSO-Required dates change?
Yes. The article's change log of Nov 10, 2026 moved the SSO-Required schedule to the dates in the table: available Nov 9, 2026 (Sandbox) and Nov 13, 2026 (Production), with auto-migration Jan 7–18, 2027 (Sandbox) and Feb 4–20, 2027 (Production). Guidance published before Nov 10, including the older knowledge article 005461455, may show an earlier, superseded schedule; use the roadmap.
Is the direct-login block the same as the SSO-Required permission?
No. They are separate rows on the roadmap. The Nov 10 change log says the direct-login row, “Direct Login Blocked for SSO Users Who Haven't Registered MFA”, was added that day. It is available Dec 1, 2026 (Sandbox) and Dec 9, 2026 (Production) and enforced Jan 7–18, 2027 (Sandbox) and Feb 4–20, 2027 (Production).
What is the Dec 1 SOAP login() date?
Per the roadmap, Dec 1, 2026 is the date for the Use Any API Auth permission. Dec 15, 2026 (Sandbox) and Jan 31, 2027 (Production) apply to requiring a security token on broad IP ranges and to disabling SOAP login() in inactive orgs. Full retirement is Summer ’27.
Is there a deadline at the end of November?
Not on this roadmap. The roadmap lists no Nov 30 date for these changes, so this page states none.
Is anything here unconfirmed?
The roadmap gives date ranges rather than the exact day within Jan 7–18 and Feb 4–20, so we state the ranges. We have not verified per-org rollout; check your own org. Salesforce's pages are the authority.
Does Wrenk check any of this?
The free health check is a short questionnaire that gives a peer-benchmarked score, with no account and no org connection. Wrenk's connected-org health check reads login and authentication configuration, and a check that cannot read the data is reported as not assessed, never as a pass.
Wrenk runs this kind of audit and the fixes that follow across every connected org as part of managed Salesforce operations.