Salesforce keeps evolving — does your security?
Every Salesforce release brings new functionality, but the Spring '26 release stands out because a large share of the updates touch directly on security and access management. Some changes are optional, others are mandatory and come with hard deadlines. Anyone who ignores this release runs the risk of vulnerabilities that could easily have been avoided.
In this article we walk through the most relevant security updates of 2026, what they mean for your organization and how to implement them correctly.
1. Saying goodbye to SOAP login: mandatory migration to OAuth
One of the most far-reaching changes in Spring '26 is the further deprecation of the legacy SOAP API login() call. In new Salesforce environments this method is disabled by default. In Summer '27 it will be fully removed for API versions 31.0 through 64.0.
What this means in practice: integrations and scripts still using SOAP login() will no longer work unless you actively intervene. The replacement is OAuth: a more modern and secure authentication method that does not require direct credential sharing.
Steps to migrate:
- Inventory all integrations and automated processes currently using SOAP login()
- Replace these with OAuth 2.0 flows, preferably the JWT Bearer Token flow for server-to-server integrations
- Test the new authentication in a sandbox before moving to production
- Remove the SOAP login() configuration after a successful migration
2. Session IDs in outbound messages have been deprecated
From Spring '26, session IDs are no longer included in outbound messages. This was a known weak spot in security, because session IDs could be intercepted in transit and misused.
The solution here is also OAuth. Systems that receive and process outbound messages must be adjusted to use OAuth tokens for authentication instead of session IDs. Check your external systems that process these messages as well: the change is required on both sides.
3. Connected Apps are being replaced by External Client Apps
Salesforce is disabling the ability to create new Connected Apps by default in all new orgs. The reason: Connected Apps carry inherent security risks that External Client Apps remove.
For existing Connected Apps nothing changes in the short term, but the recommendation is clear: migrate new integrations directly to External Client Apps and plan a phased migration for existing Connected Apps.
Advantages of External Client Apps over Connected Apps:
- Stricter access control per client
- Better support for OAuth 2.0 flows
- More granular permission settings
- Easier to audit and manage
4. Certificate management: shorter validity requires action
From March 2026, new CA-signed certificates are limited to a validity of 200 days. In 2027 this will be reduced further to 100 days. This is an industry-wide development, not specific to Salesforce, but it has direct consequences for your Salesforce configuration.
What this means in practice:
- Certificates have to be renewed more often: manual management becomes untenable
- Automating certificate rotation is no longer a luxury but a requirement
- Designate specific administrators who receive notifications about expiring certificates via the Expired Certificate Notification permission
Self-signed internal SSO certificates are exempt from this restriction for now, but the same principle applies there: a structured replacement process is always better than ad-hoc management.
5. Triple DES for SAML is being deprecated
A less visible but important change: Triple DES as an encryption algorithm for SAML configurations is being deprecated. If your organization uses SAML for Single Sign-On and still relies on Triple DES, you must migrate to a stronger algorithm such as AES-256.
Check your SSO configuration in Salesforce Setup under Identity Provider Settings and proactively replace outdated encryption algorithms before Salesforce takes them out of service automatically.
How do you tackle this?
The volume of security updates in a single release can feel overwhelming. A pragmatic approach:
- Start with the changes that have hard deadlines: SOAP login migration, session IDs in outbound messages and certificate management
- Then inventory which Connected Apps are active in your environment and create a migration plan
- Plan a Shield evaluation if you do not yet use Event Monitoring or Platform Encryption
- Document every change: this is valuable input for your next audit
Conclusion
Salesforce's 2026 security updates are not optional improvements. They are a direct response to the growing pressure from the industry, regulation and the increasing sophistication of cyber threats. Organizations that act proactively gain an edge: not only in terms of security, but also in compliance and long-term manageability.
Want to know which of these updates are immediately relevant for your Salesforce environment? Schedule a no-obligation appointment.
