Salesforce updates

Important If you have a notification from Salesforce that you don't see listed here, raise a case with our support team.

Note The time frames we've given can be subject to change, by Sage or Salesforce, and we've given them as a guide only.

Salesforce email date and title	Security update	Enforcement dates	Sage People article
20 May, 2026 - Product and service notification	SOAP retirement	Summer 2026: Optional Summer 2027: Mandated	SOAP API retirement
15 May, 2026 - Prepare for certificate changes starting June 2026	Root certificate transition	5 February, 2026	Root certificate changes
15 May, 2026 - Prepare for certificate changes starting June 2026	Reduced certificate lifespans	Until March 15, 2026, the maximum lifespan is 398 days As of March 15, 2026, the maximum lifespan is 200 days As of March 15, 2027, the maximum lifespan is 100 days As of March 15, 2029, the maximum lifespan is 47 days	Changes to certificate lifespans
15 May, 2026 - Prepare for certificate changes starting June 2026	Deprecation of dual-use certificates	Effective 15 June, 2026	Deprecation of dual use certificates
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	Email verification	Sandboxes: Starting 14 April, 2026 Production: TBD	Email verification (DKIM keys)
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	High risk connection blocking	Enforcement applied early April 2026	Security notifications - Salesforce can block user access
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	Step up authentication	Available in Sandboxes: Starting 27 May, 2026, staggered over approx. seven days Available in Production: Starting 27 May, 2026, staggered over approx. seven days Enforced in Sandboxes: Starting 3 June, 2026, staggered over approx. seven days Enforced in Production: Starting 10 June, 2026, staggered over approx. 20 days	Step up Auth for report activities
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	Phishing resistant MFA	Sandboxes: Starting 22 June, 2026, staggered over approx. seven days Production: Starting 1 July, 2026, staggered over approx. 30 days	Phishing-resistant Multi-Factor Authentication (MFA) for privileged users and admins
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	MFA for all	Sandboxes: Starting 22 June, 2026, staggered over approx. seven days Production: Starting 20 July, 2026, staggered over approx. 30 days	MFA for all
6 May, 2026 - Action required: Upgrade the security of your Salesforce experience	Transaction Security Policy (TSP) enhancement	Available in Sandboxes: Starting 1 June, 2026 Available in Production: Starting 15 June, 2026 Enforced in Sandboxes: Starting 22 June, 2026 Enforced in Production: Starting 13 July, 2026	Prepare for Transaction Security policy enhancements