Winter '27 Abridged

The Salesforce Discord Collective Presents:
THE WINTER 27 RELEASE NOTES - ABRIDGED
They named it Einstein, Copilot, Agentforce, Claudeforce, and AIforce. Your customers named it “I’ll buy when the economy improves.”

CRITICAL STUFF

• Honestly nothing for most users. Good news ! That said, remember all those security changes we’ve been warning you about for the last two releases? Profile Filtering is now enforced, SOAP login requires a specific permission from December 1, OAuth Device Flow gets restricted November 30, legacy OAuth flows retire February 20, 2027, and Connected Apps lose support in Summer '27 (they’ll still work). Also, previous email verification exceptions expire December 1. If you’ve ignored our warnings until now, your integration inventory is about to become a treasure hunt.
• OAuth Refresh Tokens now expire after 30 days of inactivity, enforced in Production starting November 4. Salesforce also revokes all existing access tokens once during enforcement, potentially requiring reauthentication. Check your low-frequency integrations, apps and token-refresh mechanisms before discovering that the quarterly integration you’ve forgotten about has also forgotten how to log in.
• If you’re still using Standard-Volume Platform Events, migrate to High-Volume before December 15, 2026, when publishing and subscribing stop working. Winter '27 gives you a migration button, because apparently even Salesforce has realized nobody wants to manually migrate obsolete event definitions.

GENERAL STUFF

• On Emails, you can disable email verification (???) see the verified emails and their domains in setup, set a fallback for users with unverified domains, and Experience Cloud can send emails via a specific email by Experience which is a reaction to the “verified only updates” from a few release back.
• Salesforce now offers an org setting to preserve manual shares when record ownership changes. It’s not enabled by default, which is sensible because changing sharing behavior without asking would be a fantastic way to make Security cry. Worth reviewing for orgs that have built elaborate workarounds around lost manual shares.
• Flow Approvals now have a request approvals component to ease selection of how to submit your record, open the next work item automatically to save you a click, allow background synchronous actions to save you a few minutes, and have a dedicated channel for their record change events. Approvers now also don’t need to see what other steps exist in the approval process so you can continue your security-through-obscurity validation
• Lightning Reports and Dashboards can now embedded in Lightning Web Runtime Experience Cloud sites.
• Monitor Org Health and Usage no longer requires Agentforce and gives some feedback (though still isn’t on the level of RIP Optimizer)
• Reports get Record Previews in the report to avoid you navigating away or openihng new tabs every time you want to view something.
• Field Service gets the capability to hide not applicable action instead of showing it lol, can also send Technicians to an LWC from a push notification, gets emergency dispatch Notifications, a few Visual Remote Assistant updates, and Data Capture Forms look nicer.
• Cases get better merging screens and inline attachments display
• Salesforce Copying our grouping style lol ‘We added Release Note Changes by product.’, and they merged “Released Montly” into Release Notes Changes, which IMO is great news.

FLOWS

• Flow User Context changes to be more selective which means you’ll need to review how Flows are called and which permission you want to assign when upgrading to API v68. Same upgrade consideration for End elements which are now metadata
• Edit history is a powerful feature that builds upon the previous work to rationalize Flow Comparisons behind the scenes by the team, which is even bleeding out into Data 360 and Marketing Flows great stuff.
• The Test Harness becomes ever-more refined, allowing easier tests and reproductibility. Agentforce can also fail at being useful there
• You no longer need secret variables or VF Pages to pass record collections to Flows from a button
• Winning the “unclear-iest note of today”, Reactive Formulas for Conditonal Visibility allow you to build screens with components that appear and disappear based on other components on the same screen.
• Flow DML commits get automatic retries, preventing save failures through CPU wastage
• Auto-generated element labels and better Decision management will bring up the skill floor on Flow maintenance, and that’s lovely. Same for unused resources, easy for cleanup. Flow performance on canvas shows you if you built a franken-flow.
• Grouping Elements looks like a good idea, but if elements can be logically grouped and independent, why shouldn’t they be a subflow instead ?
• CONTAINS() no longer causes a runtime error on pink Flow elements (though the fact that you chose a multi-select picklist is a runtime error itself)
• The Split by Date/Value element feels like “we made this sledge-hammer more kid-friendly by adapting the rubber on the hand grips”

DEVELOPMENT

• Non-public system fields will disappear from Aura action responses in Spring '27. If your Aura components depended on fields that weren’t part of the public API, review them now. Salesforce is removing something you weren’t meant to rely on, which naturally means somebody out there definitely relied on it.
• You can use Third Party web components in LWC (GA), and use what they call Microfrontend to embed full existing web apps directly in a Salesforce page with data and styles exchange. Seems very powerful, but didn’t Salesforce generally hate this sort of thing for “security” ?
• Integration tests (Dev Preview) call real HTTP endpoints with no mocks and get @BeforeClass. They were already in Summer '26. Nothing rolls back, so write your teardown. The Test Discovery API’s testLevel replaces showAllMethods from API v68, so check your CI scripts.
• Platform Event Triggers can now roll back if it throws unhandled exceptions
• Elastic limits (Beta) now cover Batch. Per the dev guide, past the daily async limit you get throttled to one active Batch job, and past the elastic limit you get exceptions as before. It’s production only, scheduled jobs are excluded, and use is “at the Customer’s sole discretion” under the Beta terms. Salesforce’s answer to “you ran out of async” is “run slower, in beta”. Override the limit in nonprod to see the throttling before prod shows it to you.
• The heap limit goes up to 10 MB sync and 25 MB async, but CPU time is unchanged, so you’ll hit the CPU wall instead.
• You can now compare fields in SOQL via FORMULA(). Great time saver for Admins who know how to write SOQL as well. (beta, conditions apply)
• The Apex Symbol API (Beta) exposes type metadata for IDEs and “AI agents generating Apex”. It also reads your ApexDoc, so if you wrote none, your agent only has your method names.
• Housekeeping: recompile only invalid classes and triggers instead of the whole org. Compiler warnings for API 9.0 to 19.0 are your retirement notice, so move to 20.0 or later. If you still have a v12 trigger in prod, that’s an archaeology project. CLI versions at or above 2.154.3 also get a CLI command for that under sf apex get compile-status.

MARKETING

• The Marketing Cloud Next release notes continue reading like a Marketer’s wet dream with self-optimizing agent campaigns, Agents to automatically qualify leads, goal-driven marketing campaigns, an actual performance metric dashboard that looks actionable and more. Now of course, when you wake up in your now-soiled sheets, you notice that the thing that stops Agentforce from carpet-bombing the same person, Adaptive Campaign Audiences, is still Beta. You also notice that the pricing is “there’s a multiplier”, and the rate card has had four versions since October '25. It also says multipliers “may be updated from time to time”. Sooo maybe don’t migrate to MCNext yet. And just outsource your marketing campaigns to Fiver or something so you get metered bad campagins instead of unmetered bad ones.
• If you use Marketing Cloud Advanced, you can send outbound email through your own servers to improve deliverability.
• Salesforce has now discovered utm parameters, not a year too soon.

DATA CLOUD 360 Sigh-force

• Running Python code on #zero-copy data is very nice, but I assume that means all the data is stored in RAM on run? Fun consideration for security specialists auditing that functionality.
• Data 360 gets multiple improvements to clustering, and exposes more prediction functions, but if you’re so deep in ML, why use Data Cloud rather than one of the more competent alternatives ?
• The Data360 Engagement Timeline is the component Marketers love except it’s not even available in MCNext lmao
• Data Cloud Reports get Joined Report options, and Formulas now include AI sentiment to analyze a text field on the fly. Powerful.
• The Drill Down option in Reports allows easier viewing of subcategories in both object and user hierarchies
• Multiple Currencies in Data Cloud seem as well implemented as in Salesforce core :kek:

AGENTFORCE

• Works sometimes, bills always. Salesforce’s SVP of Product Marketing told The Information the company had “more trust in the LLM a year ago”. Its COO of AI added that “90% consistency is not okay” in finance or healthcare, hence the pivot to deterministic Agent Script. Another exec says Help Agent accuracy dropped after GA, and customers’ agents go from high-80s/90% in test to 50-60% live. Always: MCP. Every successful call from a registered agent, over MCP or direct API, is a “Headless Platform Interaction” that will become paid in Flex Credits. The multiplier is “TBA” on the 08.31.2026 rate card. They’re “targeting November”, you get 30 days’ notice, and registration is mandatory (existing customers migrate at renewal). SalesforceBen adds that the cost per interaction is fixed while the number of interactions “depends entirely” on the third-party agent. Buyers are already being told to budget the Salesforce meter and the inference bill as two lines, and to treat the first as “unknown unit economics” until it has a number. The r/salesforce threads (July, September) are a fun read. One user is already seeing Claude connector calls “show up as ‘agentic’ in the API usage logs”, with “no way of monitoring” them. Another asks “how would they know what agentic vs not?”, since the backup tool, ERP and Power BI all hit the same platform APIs. If that tag becomes a meter, you pay Salesforce for Claude to read your org, then pay Claude for the tokens it burns doing it, on top of your licences. Meanwhile Winter '27 shoves MCP into everything: MCP Server Tools for Agents, Registry MCP Cards, In-Flow AgentExchange Installs, Install Requests (Beta) and Install Approvers (Beta). Whether you pay at all depends on the metering doc: the Unmetered User-Based AI permission, plus the action running as the current user. Support told us it also depends on user type (Standard or Admin) and implementation. Same click, metered or free depending on who made it. For the C-suite: the brake is the one you build. Digital Wallet alerts only notify, and a Reddit PSA shows credits burning with no guardrail. Set low thresholds with a named owner. Review Consumption Insights, Product Limits and GenAI prompt usage weekly, and read the FAQ on how consumption is calculated. Don’t sign a volume commitment until the multiplier is a number. Then check whether each agent or MCP integration still saves money after credits, token bills and failure rate, and kill the ones that don’t.
• Keep an eye on Salesforce’s model rerouting notices. An agent or prompt using a Salesforce-managed model can change behavior when the underlying model is replaced. If you’re deploying these things in production, regression tests need to cover vendor-driven model changes, not just your own releases.
• Einstein Bots are dead, long live Agentforce (you can migrate automatically)
• Agentforce Coworker a paid Agentforce for Agentforce in case you wanted more Agentforce, can now create and update Records as well as burn unknown amounts of tokens to call other agents
• Service and Employee Agents now get file uploads through a SubAgent that’s configurable through AgentScript as well.
• Connection-Specific Display and Instructions means the same agent can behave in slightly different ways depending on user device and method of comms.
• Dynamic Messaging allows agents to have responses that leverage the existing messaging components from Chat, which makes for a very interactive flow. At some point we’ll have forms in Agentforce, and clicks instead of text. We’ll put all that on the main screen and display all the record data there and… oh wait.
• Pain Removal: Custom Lightning Types don’t require 5 clicks before you can preview them now, and Agent Metadata Should be less of a pain to deploy, wondering if that fixes the Agentscript deployments as well.

DOGELAND

• :doge: Trust us ! Sure we got hacked 10 times this year but storing full conversations with your employees on a system that hasn’t been proven to be secure is a GREAT idea.
• :doge: Open CTI joining the ranks of the almost-newly killed and requesting you to use a shitty proprietary API that doesn’t have feature parity :D
• :doge: Trusted AI which had no guardrails in the field generation screen allowing any query kek.
• :doge: Apex cursors over Data 360 DMOs (Beta) tell you to monitor “Data 360 Flex Credit limits”. Your Cursor.fetch() now has a meter attached.
• :doge: Setup with Agentforce now requires Data Cloud again but not Data 360. Confused ? So is the AI who wrote these notes.
• :doge: soooo which is it ?
• :doge: A developer guide that has beginner examples which don’t even properly explain authentication kek. Throw that on Trailhead, and put real documentation in here.
• :doge: “We forgot there’s a “collection filter” element so here’s a new shittier one that returns a single record for some reason”

This abridged version was graciously written up by the SF Discord

We have a nice wiki: https://wiki.sfxd.org/

And a LinkedIn page: https://www.linkedin.com/company/sfxd/

Join the ~18000 members in the most active chat-based community around Salesforce these parts of the web at http://join.sfxd.org/