As Autumn arrives and the leaves begin to turn, Salesforce has rolled out its Winter 2027 release—marking the 68th version of the platform. The official release notes are as comprehensive as ever. Sandboxes were upgraded back in late August, and your live Salesforce deployments are rolling out across early October. Below, we’ve highlighted the key updates, security changes, and new features that matter most to our clients and Salesforce administrators.

One theme that we’re continuing to see pushed more and more is a real focus on security. We are continuing to see plenty of high profile security breaches across the industry and the world. The landscape is changing quickly and Salesforce is adapting to the fast changing environment.

Improved Org Health & Setup 

Another theme of recent releases seem to be trying to simplify user experience and expose and simplify critical functionality. This combined with the focus on security gives admins more visibility of potential issues in their org.

• Org Health & Usage Available to All Admins: You no longer need special Agentforce licenses enabled just to view org health. The Org Health and Usage dashboard is now directly available in Setup for all system administrators. This exposes charts reporting on key org health metrics such as Data Exposed to Guest Users and Security Health Score.

• Expanded Advisements & In-App Notifications: The Advisements engine (beta) now scans for potential implementation risks, including Content Security Policy (CSP) violations, outdated API versions, and unused Data Detect scans. When risks are detected, admins receive direct notifications in their notification tray.

• Agentforce Assistance: With Agentforce integrated into Setup, admins can interact with AI to investigate health metrics, compare user access permissions, analyse login errors, and get instant recommendations on how to remediate potential issues. This is a great use case for AI - searching through pages of data to identify and explain issues succinctly.

The Salesforce org health dashboard

Visual & Canvas Enhancements in Flow Builder

Salesforce Flow continues to receive plenty of upgrades to both functionality and management of Flows

Group Elements to Organise Complex Flows: As Flows become more functional and complex, they can become difficult to read and understand. In Winter 2027, it is now possible to manually group together sections of your Flow and collapse them. This enables you to focus on individual parts of the Flow at a time, making them easier to follow. 

Group Salesforce Flow Elements

Simplified Pathing & Decision Navigation: Instead of using a Decision element in a Flow, it is now possible to use a Split component. This works in a similar way to a decision, but is much simpler. For a Split, you can use a single text field or date relative to today and split the flow based on that value only. Particularly powerful for picklists where a picklist can dictate a different process for your flow to follow.

Flow Split Component

Release Updates: Looking Ahead

Looking slightly ahead, we can see some changes coming in the next few releases that will require attention sooner rather than later to ensure a smooth transition. Here are some of the most critical release updates and upcoming changes your team should prepare for:

• Asynchronous Sharing Recalculation: If you have manual sharing calculations already set up in Salesforce, how these sharing calculations are applied may need to change. Going forward, all sharing will need to be processed asynchronously. If you have sharing calculations that currently work synchronously (immediately), these may well need updating. 

• Retirement of Legacy SOAP APIs & Username-Password Auth: SOAP API versions 31.0 through 64.0 are scheduled for retirement. Additionally, connected apps using the legacy OAuth 2.0 Username-Password flow will cease working in February, and all connected apps must be migrated to External Client Apps by Summer '27.

• Email Domain Verification & Fallback Addresses: For users sending emails from unverified domain addresses (such as external contractors or volunteers acting through your org), administrators can now configure an Organization-Wide Email Address to serve as a substitute "From" address. This ensures outgoing emails remain aligned with your company's brand and pass email authentication checks.

Final Thoughts

There’s certainly plenty to dive into following the Winter 2027 release this October. This release includes plenty of upgrades to what an admin can do and see. If you’d like to explore the full details, take a look at the official Release Notes or head over to Trailhead for hands-on learning modules. On a broader scale, with the rise of AI, it’s never been more important to keep your Salesforce org as secure as possible. As always, feel free to get in touch with our team if you need guidance preparing for the release or what lies ahead!