Limit API Access for External Users
To enhance security, you can restrict community and portal (external) user access to Salesforce APIs through connected apps that are installed in your org. Previously, you weren’t able to restrict only external user access to Salesforce APIs.
Where: This change applies to Lightning Experience and Salesforce Classic in Professional, Enterprise, Performance, Unlimited, and Developer editions.
Who: This feature applies to external users only.
How: Contact Salesforce Customer Support to enable API Access Control for your org. Then enable For external users, limit API access to only installed connected apps. Install a connected app on the Connected Apps OAuth Usage page.
Prevent Identity Verification by Email
All new Salesforce orgs are now set up so that identity verification by email occurs only if the user has no other identity verification methods registered. Possible identity verification methods include Salesforce Authenticator, SMS, time-based one-time password (TOTP), physical key (U2F), and email. The new setting, Prevent identity verification by email when other methods are registered, appears on Identity Verification and Session Settings Setup pages. To increase security in your existing orgs, Salesforce recommends that you enable this setting.
Where: This feature applies to all editions of Salesforce Classic and Lightning Experience. It also applies to all Lightning and Salesforce Tabs + Visualforce communities accessed through Lightning Experience and Salesforce Classic in Essentials, Enterprise, Performance, Unlimited, and Developer editions. SMS verification messaging is available in Lightning Experience, Salesforce Classic, and all versions of the Salesforce app. The Identity Verification Credits add-on license is available for purchase for all editions.
Who: Customers who have an Identity Verification Credits license and use device activation by text message can enable identity verification by text message. If you don’t know your org’s limit of SMS messages for identity verification, contact your Salesforce account rep. On external users’ profiles, the option Enable Device Activation allows external users to verify their identity by text message.
How: From Setup, in the Quick Find box, enter Identity Verification, and then select Prevent identity verification by email when other methods are registered.
Verify Your Domain Name for External Services
Some external services require you to prove control over your domain name. You can now verify your domain name from the Domains Setup page.
Where: This change applies to Lightning communities accessed through Lightning Experience and Salesforce Classic in Enterprise, Essentials, Performance, Unlimited, and Developer editions.
Why: External services use various methods to prove domain ownership. Some external services, such as Sign In with Apple, provide you with a verification file that you download to your computer. Store the file on your domain at a location specified by the external service. If the service can locate the file, your domain is verified.
How: You verify your My Domain or community domain from the Domains Setup page. Next to the domain, select Verify, and then choose the verification file that you downloaded from the external service. Salesforce then stores the file at the location specified by the external service.
Let Users Log In to Salesforce with Their Apple ID
Using the new Apple authentication provider, your customers can log in to a Salesforce org or community with their Apple ID.
Where: This change applies to Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.
How: To let users log in with their Apple ID, create an Apple authentication provider from the Salesforce Auth. Providers Setup page. After configuring the authentication provider and adding the Apple sign-in button to your Salesforce and Communities login pages, users can log in with their Apple credentials.
Authentication and Identity: Apple Sign-In, Identity Verification, and API Access Control
Enable Apple sign-in for your orgs and communities, allowing users to authenticate with their Apple ID, Face ID, or Touch ID. Enhance identity verification security by storing domain verification files for external services and enabling verification methods that are more secure than email. Restrict external user access to Salesforce APIs through connected apps that are installed in your org or community. And apply the Request Signature Methods to single logout, have extra time to approve OAuth authentication requests, and troubleshoot bridged OAuth sessions.
Changes to Managing User Preferences
Access to UserPreference records of other users in the SOAP API is available for users with the View All Data or Manage Users permission, but all users can access their own UserPreference record.
Where: This change applies to Lightning Experience and Salesforce Classic in Professional, Enterprise, Performance, Unlimited, and Developer editions.
Permission Changes for Administrator Tasks
To access permissions or permission set groups, users must have the View Setup and Configuration permission or the equivalent permissions to manage permission sets or users, including Manage Session Permission Set Activations, Manage Users, and Assign Permission Sets.
Where: This change applies to Lightning Experience and Salesforce Classic in Professional, Enterprise, Performance, Unlimited, Developer, and Database.com editions.
Secure Your Sandbox Data with Salesforce Data Mask
Salesforce Data Mask is a powerful new data security resource for Salesforce admins and developers. Instead of manually securing data and access for sandbox orgs, admins can use Data Mask to automatically mask the data in a sandbox.
Where: This change applies to Lightning Experience in Enterprise, Performance, and Unlimited editions.
Why: Data Mask uses platform-native obfuscation technology to mask sensitive data in any full or partial sandboxes. The masking process lets you mask some or all sensitive data with different levels of masking, depending on the sensitivity of the data. Once the data is masked, you can’t unmask it. This irreversible process ensures that the data is not replicated in a readable or recognizable way into another environment.
How: Data Mask is a managed package that you install in a production org. You then run the masking process from any sandbox created from the production org.
Require Permission to View Record Names in Lookup Fields (Critical Update)
To better protect your Salesforce org’s data, we restrict who can view record names in lookup fields. Beginning in Winter ’21, users must have read access to these records or the View All Lookup Record Names permission to view this data. This critical update also applies to system fields, such as Created By and Last Modified By.
Where: This change applies to Lightning Experience and Salesforce Classic in all editions.
When: This critical update is enforced with the rollout of the Winter ’21 release.
How: Admins can enable the View All Lookup Record Name permission in custom profiles or permission sets. Only enable this permission for users who must see record names in all lookup and system fields, regardless of sharing settings.
We recommend that you test this update in a sandbox or Developer Edition org before enabling it in your production org.
To activate this critical update before Winter ’21, from Setup, enter Critical Updates in the Quick Find box, then select Critical Updates. For Require Permission to View Record Names in Lookup Fields, click Activate.
Make More Connections the Enhanced External Services Way (Generally Available)
nhanced External Services are generally available and enabled by default. It's easy to use, and provides more ways to create and connect to outside services. Now, when you register a service, you get support for more complex OpenAPI 2.0 schema, nested object types, and send parameters as headers within the HTTP requests.
Where: This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions.
How: After turning on Enhanced External Services, register new external services the same way you did before. Actions generated by your schema are created as External Service Actions in Flow Builder.
Existing registrations are not automatically migrated to Enhanced External Services. For existing registrations to use the new features in Enhanced External Services, you must re-register the schema, update the flows that use the old Apex Action to the new Enhanced External Service Action and delete the old registration.