Winter '27 is an enforcement-heavy release: several previously optional release updates become mandatory starting September 2026.
Where
Setup, under Release Updates. Each item below is flagged there ahead of enforcement.
How
Key updates being enforced: Adopt Authorized Email Domains retires Support's ability to disable email change verification, so orgs need DKIM keys or Authorized Email Domains configured for bulk email updates. Enable Profile Filtering restricts profile name visibility to the user's own profile unless View All Profiles is granted, which affects any validation rule, flow, Apex class, component, or report that references other users' profiles. The OAuth 2.0 Username-Password flow for Connected Apps is retired, so integrations must move to External Client Apps with modern authorization flows. Accessibility styling enhancements for cards, docked containers, menu lists, and panels at 200 percent or higher zoom are also enforced, along with a tax rate calculation correction for Order Management adjustments.
Why
Each of these can break existing functionality if ignored. Audit your automations and integrations for profile name references and username-password authentication now, test in the sandbox preview, and you will avoid surprises on your production upgrade weekend.