A security tightening that will break older integrations if their integration user lacks one permission.
Where
SOAP API authentication, the login() call. Permission lives on profiles and permission sets as 'Use Any API'.
How
Audit every integration user that authenticates via SOAP login() and confirm it holds Use Any API. Users without it will fail to authenticate once the change is in effect in your org.
Why
Aligning SOAP login with the API access rule closes a gap where a user without API permission could still obtain a session through the legacy path. Check data loaders, middleware and old scheduled scripts first; they are the usual SOAP holdouts.