Winter ’26 includes enforced changes that can affect access, automations, email, and integrations. Here is the focused list, plus the actions Salesforce owners and admins should take.
Restrict User Access to Run Flows
Enforced in Winter ’26What's changing
Users need explicit permission to run each Flow. Broad or implicit access no longer works after enforcement.
Action steps
- Inventory who launches each high-traffic Screen and Autolaunched Flow.
- Assign Run Flows and narrower flow-level permissions where appropriate.
- Regression-test critical flows in a Winter ’26 sandbox.
Secure Roles Behavior & Sharing Group Label
Enforced in Winter ’26What's changing
In orgs without Digital Experiences, the default group label becomes “Role and Internal Subordinates.” References to the previous string must be updated.
Action steps
- Search metadata for old role-and-subordinates references.
- Update the references and validate the deployment in a sandbox.
Confirm Verified Email Addresses
Legacy-user enforcementWhat's changing
Only users with verified email addresses can send email from Salesforce, which especially affects accounts created on or before November 1, 2016.
Action steps
- Identify active legacy users with unverified email addresses.
- Send verification links and review DKIM and return-path configuration.
Update Instanced URLs in API Traffic
Winter ’26 sandboxes; Spring ’26 all orgsWhat's changing
API traffic must use your My Domain host instead of hard-coded instanced URLs such as naXX.salesforce.com.
Action steps
- Replace instance hosts in middleware, scripts, ETL tools, and packages.
- Use the My Domain blocking option in a sandbox to validate first.
Review Apex Permissions Used by Flow
Enforced in Winter ’26What's changing
Flows invoking built-in Apex behavior will respect the permission requirements defined on those classes.
Action steps
- Review Flows that call Apex actions.
- Confirm running users have the required permissions or refactor the execution context.