MFA Enforcement for Salesforce Orgs Is Shifting to In-App Notifications Starting in Summer ’24
As we previously communicated, the contractual requirement to use multi-factor authentication (MFA) for Salesforce products is in full effect as of February 1, 2022. To help customers satisfy this requirement, Salesforce automatically enabled MFA for direct logins to existing production orgs. And starting April 2024, MFA is turned on by default for new production orgs. Because of high MFA adoption rates for products built on the Salesforce Platform, we’re shifting to a new notification model instead of enforcing MFA in Summer ’24.
Where: This change applies to Lightning Experience, Salesforce Classic, and all Salesforce mobile apps in all editions.
When: Salesforce completes auto-enabling MFA for customers’ orgs in Spring ’24. MFA non-compliance notifications are targeted to begin in Summer ’24, in lieu of the MFA enforcement milestone that was scheduled for the same release.
Why: The Salesforce program to automatically enable MFA has been extremely successful thanks to the partnership of our customers and their commitment to safeguarding user account access. Because of high adoption rates and wanting to be respectful of your time and resources, we’re shifting away from the original plan to technically enforce MFA. Instead we’re implementing in-app notifications that appear if MFA has been disabled for a Salesforce org.
How: With upcoming MFA notifications, admins start receiving in-app messages if the Require multi-factor authentication (MFA) for all direct UI logins to your Salesforce org setting is disabled after Salesforce turns it on for your production org. These recurring messages warn that the org is out of compliance with the contractual MFA requirement and provide guidance on how to re-enable MFA. More details are coming in the Salesforce Summer ’24 Release Notes.
MFA Enforcement for Salesforce Orgs Is Shifting to In-App Notifications Starting in Summer ’24
Allow the New Setup Domain to Ensure Access to Salesforce Setup Pages
If your company controls users’ or servers’ access to the internet through firewalls or allowlists, your IT department must add *.salesforce-setup.com to the company’s list of allowed domains. Salesforce Setup pages are now hosted on that domain.
Where: This change applies to Lightning Experience in all editions.
When: This change is applied on a rolling basis starting in Spring ’24. The change is first enabled in sandbox and non-production orgs, then in production orgs.
Allow the New Setup Domain to Ensure Access to Salesforce Setup Pages
Add Multiple Entries for the Same Child Product
In the Salesforce CPQ external configurator, when using the Dynamic option selection method to configure a bundle feature, sales reps can add the same child product on multiple lines. This feature lets sales reps configure each child product individually rather than only increasing the quantity of a single line item.
Where: This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in Salesforce CPQ Plus.
Add Multiple Entries for the Same Child Product (salesforce.com)
Create More Complex Nested Bundles
In the Salesforce CPQ external configurator, you can now configure bundles that contain up to three levels of nested child products. The nested child products can include two levels of nested bundles and one level of nested options.
Where: This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in Salesforce CPQ Plus.
Create More Complex Nested Bundles (salesforce.com)
Experience Browser Performance Improvements for Salesforce CPQ (Release Update)
With this update, Salesforce CPQ runs faster in supported web browsers by employing Web Components V1 technology. This update was first made available in Summer '21 and is enforced in Winter '23.
Where: This change applies to Lightning Experience, Salesforce Classic, and the Salesforce mobile app in Salesforce CPQ.
When: This update was first made available in Summer '21 and is enforced in Winter '23. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and click the maintenance tab.
How:
With Web Components V1 technology, Salesforce CPQ runs faster, but the look and feel of your customizations can change. We recommend that you test your customizations on desktop and in the Salesforce mobile app, focusing on these features.
- Quote line editor
- Product selection
- Salesforce CPQ favorites
- Product bundle configuration
- Quote calculator plugin
- Page security plugin
After the update is applied, depending on your customizations and the browser, some differences in the user interface are expected. To learn more about these known differences, see Knowledge Article: UI Changes Caused By Browser Performance Improvements for Salesforce CPQ.
If you encounter unwanted differences that can’t be resolved by modifying your customizations and you want to disable the update, contact Salesforce CPQ Support.
Experience Browser Performance Improvements for Salesforce CPQ (Release Update)
Improve Security by Enabling Integration User for Calculations
In Salesforce CPQ, you can now access the external calculation service with an integration user and a short-lived access token. This method of accessing the external calculation service replaces the current method of using a user and long-lived refresh token and improves security, as Salesforce no longer stores the long-lived token.
Where: This change applies to Lightning Experience and Salesforce Classic in Salesforce CPQ.
How: In Settings, find and open Installed Packages. Next to the Salesforce CPQ package, click Configure.
On the Pricing and Calculation tab, select Use Integration User for Calculations. The existing refresh token is removed and the Salesforce CPQ Integration User permission set is created. The new permission set is then added to the CPQIntegrationUserPermSetGroup permission set group.
Test the new setting by running a calculation from a quote. Then, verify that you can amend and renew a contract that is created from an opportunity. If these processes finish without errors, you’re now using the new method of accessing the calculation service.
If an error occurs, update the CPQIntegrationUserPermSetGroup permission set group to grant the integration user access to custom fields or objects used during quote calculations. For example, add a permission set to the permission set group.
Improve Security by Enabling Integration User for Calculations (salesforce.com)
Salesforce CPQ
A Salesforce CPQ update improves security, a release update improves browser performance, and the Salesforce CPQ External Configurator functionality is enhanced.
- Improve Security by Enabling Integration User for Calculations
In Salesforce CPQ, you can now access the external calculation service with an integration user and a short-lived access token. This method of accessing the external calculation service replaces the current method of using a user and long-lived refresh token and improves security, as Salesforce no longer stores the long-lived token. - Experience Browser Performance Improvements for Salesforce CPQ (Release Update)
With this update, Salesforce CPQ runs faster in supported web browsers by employing Web Components V1 technology. This update was first made available in Summer '21 and is enforced in Winter '23. - Create More Complex Nested Bundles
In the Salesforce CPQ external configurator, you can now configure bundles that contain up to three levels of nested child products. The nested child products can include two levels of nested bundles and one level of nested options. - Add Multiple Entries for the Same Child Product
In the Salesforce CPQ external configurator, when using the Dynamic option selection method to configure a bundle feature, sales reps can add the same child product on multiple lines. This feature lets sales reps configure each child product individually rather than only increasing the quantity of a single line item.
Tighten Security for Unauthenticated Guest User Scenarios
Create and assign the Field Service Guest User permission set to provide permissions for unauthenticated users to run appointment booking and scheduling actions. Salesforce is improving guest user security, and this new permission set helps you adhere to the security requirements for guest users.
Where: This feature is available in Lightning Experience in Enterprise, Unlimited, and Developer editions with the Field Service managed package installed.
When: Starting in Spring ’22, you can no longer assign guest users permission sets or permission set groups associated with permission set licenses that contain View All, Modify All, Edit, and Delete standard object permissions. In Winter ’23, Salesforce enforces this update and removes the affected permission set and permission set group assignments from guest users. If you’re affected, Salesforce Customer Support contacts you directly about your process and timeframe for the update.
How: In the Field Service Admin app, Field Service Settings tab, click Getting Started, and then click Permission Sets. On the Field Service Guest User tile, click Create Permissions or Update Permissions.
Tighten Security for Unauthenticated Guest User Scenarios (salesforce.com)
IP Addresses Are No Longer Allowed for Domain Certificates That Serve Your Experience Cloud Site
If you use A records that point to IP addresses for your custom domains serving your Experience Cloud site, you can no longer view or use the IP addresses on the Certificate and Key Management page in Setup.
Where: This change applies to Aura, LWR, and Visualforce sites and accessed through Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.
Add Server Name Indication (SNI) for Requests to Custom Domains That Serve Your Experience Cloud Site
If you use Salesforce Edge Network, update your API client callers to include the SNI extension. This extension is required to provide the correct certificate for incoming custom domain requests.
Where: This change applies to Aura, LWR, and Visualforce sites served by a custom domain and accessed through Lightning Experience and Salesforce Classic in Enterprise, Performance, Unlimited, and Developer editions.