Winter ’27 arrives on a date you don’t pick — the rest of this is yours to assign.
Sandboxes upgrade at the end of August; production follows in October, and the weeks between are your only test window. Inside: what Winter ’27 enforces, which half of security is yours, why tech debt goes unfunded, and a new agent for your admin.
Winter ’27: Your Five-Week Window
Winter ’27 is an enforcement release, not a feature release. Several release updates change behavior on your upgrade date, tested or not.
- The OAuth 2.0 username-password flow retires for connected apps
- Authorized Email Domains, with change verification no longer optional
- Profile filtering limits users to their own profile name
- Integrations on that flow stop getting tokens and fail silently
- Old middleware, data loaders, and vendor connectors top the list
- Sandbox preview opens around Aug 29 — verify your org’s date
Where Salesforce’s Security Job Ends and Yours Begins
More than half of Salesforce professionals say they’re unfamiliar with the Shared Responsibility Model. Salesforce secures the platform. Everything below is yours.
- Configuration, user access, and permission design
- Your data, including backup and recovery
- Every integration and the credentials behind it
Tech Debt Doesn’t Have an Awareness Problem
Tech debt ranked the biggest challenge for Salesforce teams two years running, and only 2% call their org clean.
- 80% say executive support to tackle it is inconsistent, unclear, or absent
- 45% are often asked to build without clear requirements, creating more debt
- What admins say helps most is protected, dedicated cleanup time
Your Admin’s First Useful Agent Is Already in Setup
Setup with Agentforce is now generally available. Not customer-facing, and that’s the point: it does what your admin repeats every week.
- Creating objects and fields, and troubleshooting formulas
- Explaining and comparing user permissions and access
- Org health, license consumption, and Setup Audit Trail review
Skills vs commands: building an agent OS you can move anywhere
COO Tim Harting and Head of Custom Development Gavin Franklin close the Agentic OS series on the portable skills-and-commands layer that holds your company’s process without handing a vendor a lock on it. Same thread as this issue: own it, then decide who runs it.
Everything here is somebody’s job.
The thread through all of this: Winter ’27 arrives on a schedule you don’t control, and nearly everything else here is something your org already owns and hasn’t assigned. Name an owner for the integrations, the access model, and the cleanup time. October gets decided in August.
Use the Preview Window, Not the Upgrade Weekend
Not sure which integrations still run on the retiring OAuth flow, or who owns your half of the security model? We’re offering managed services clients a complimentary Security Health Check to inventory both before Winter ’27 reaches production. Talk to your Cirrius Consultant.
*Dates follow Salesforce’s published release calendar and vary by instance; verify against your org’s schedule in Setup → Release Updates.
