If you run a business on Salesforce, you’ve probably heard that a new release is coming. You may have even gotten an email from Salesforce about it. And like most business owners, you may have filed it under “something my team handles” and moved on.

That approach is going to create problems this summer.

The Summer ’26 release is different from a typical update cycle. Several changes are being enforced — not rolled out as optional features — and some of those changes have deadlines that are already here or weeks away. Others signal a meaningful shift in how the platform is being built for the next few years. Business leaders who stay informed are going to be better positioned to ask the right questions of their teams, avoid disruption, and take advantage of what’s actually ready to use.

Here’s what you need to know.

Security Is Being Enforced, Not Suggested

The most urgent part of this release is a coordinated wave of security changes. Salesforce is tightening how users log in, how users with elevated access authenticate, and how the system handles activity around reports. None of these are optional.

The reason Salesforce is doing this now comes down to AI. As the platform expands into more AI-driven capabilities, the underlying security infrastructure has to be airtight. More powerful tools require stronger controls, and Salesforce is building those controls into the platform before expanding further.

MFA Is No Longer Optional for Anyone

Multi-factor authentication, the second step you take when logging in to verify your identity, has technically been required in Salesforce for a while. But there was a permission that allowed businesses to waive that requirement. That permission is going away. Every user, regardless of their role or access level, will be required to use MFA going forward.

For most businesses this is a straightforward change. If your team is already on MFA, there’s nothing to do. If anyone has been operating with a waiver, that window is closing.

Admins and Power Users Face a Stricter Standard

Users with elevated access — system administrators and others with broad permissions to configure or modify the platform — are being held to a higher standard called phishing-resistant MFA. A standard authenticator app is no longer sufficient for these users.

In plain terms, they’ll need to authenticate using either a physical security key or the fingerprint reader built into their computer. For most teams this is a manageable change — Touch ID on a MacBook qualifies — but it requires intentional setup and communication.

This change is also a natural prompt to review who in your organization actually has admin-level access. In many businesses, elevated permissions get granted for convenience and never revisited. Users who have those permissions will now face an additional authentication requirement every time they log in. If someone doesn’t need that level of access, this is a good moment to right-size it.

Your Team May Get Stopped When Running Reports

There’s a third security change that’s going to affect day-to-day work: step-up authentication for reports. When Salesforce detects what it considers unusual activity around running or viewing reports, it will prompt that user to verify their identity again before the report loads.

What counts as unusual isn’t precisely defined by Salesforce, but the intent is clear — they’re protecting against unauthorized data exports. A sales rep running their usual morning report might occasionally get flagged and asked to re-authenticate. This is not a glitch. It’s by design.

The most important thing leaders can do right now is make sure their teams know this is coming. When it happens, users should be able to re-authenticate and pick up right where they left off. The disruption is minimal if people understand what’s happening. If they don’t, it’s going to generate a lot of unnecessary support requests.

AgentForce Is Moving From Experiment to Infrastructure

AgentForce has been the headline feature in Salesforce marketing for the past year. What this release signals is that it’s no longer in the experimentation phase — it’s being built into the core infrastructure of the platform.

Two specific changes stand out.

Salesforce has made AgentForce available directly inside setup — the part of Salesforce where administrators configure the platform. This means an AI agent can now assist with tasks like granting permissions or creating fields, without a person having to manually click through every step. It was released as generally available a few weeks before this release window, and it represents a meaningful shift in how administrative work gets done.

The second change is a new performance dashboard. For the first time, business leaders can see in concrete terms what their agents are doing, how often they’re being used, and whether they’re delivering value. This matters because one of the biggest obstacles to AI investment has always been the inability to answer a simple question: is this actually working? That dashboard starts to answer it.

One thing worth noting: while setup actions don’t consume the standard AgentForce credits, they do use a small amount of Data Cloud credits. Salesforce has indicated they plan to eliminate this, but it hasn’t happened yet. As your team starts using AgentForce in setup, it’s worth keeping an eye on that consumption until the policy changes.

Automation Gets Easier to Build and Easier to Manage

Salesforce Flow — the engine that drives most automated processes inside the platform — received several updates in this release. The through-line across all of them is friction reduction. Things that previously required workarounds, outside tools, or custom development now work natively.

Scheduled flows, which run automations on a recurring basis, used to process records in a fixed batch size that frequently caused errors — timeouts, record locking, failed jobs. You can now control that batch size directly, which eliminates a category of problems that has historically required developer involvement to resolve.

Teams can now navigate users directly to a record or an external page from within a flow, something that previously required custom code. Toast messages — small confirmation notifications — can now appear at different points throughout a flow rather than only at the end, giving users clearer feedback as automated processes run.

The update that may have the most long-term impact for businesses managing complex Salesforce environments is flow version comparison. You can now pull up two versions of any automation side by side and see a precise breakdown of what changed between them. Previously, tracking those changes was largely manual. Now it’s built in.

For business owners, this translates to less time spent troubleshooting, fewer emergency calls to your Salesforce team, and more confidence that changes to your automation are being made deliberately and with full visibility.

Salesforce Is Being Built for AI to Act, Not Just Assist

There’s a broader architectural shift happening in this release that doesn’t get as much attention as the feature updates but matters more in the long run.

Salesforce is building the infrastructure to allow AI agents to operate inside the platform as though they were users. Not just to surface information or make suggestions, but to take action — running reports, triggering processes, updating records, moving work forward without a person driving every step.

Until recently there were real limitations on what AI tools could do inside Salesforce. This release pushes those boundaries significantly. Salesforce is also now hosting its own MCP servers — a standard that allows external AI tools like Claude or ChatGPT to connect to Salesforce more directly, understand what’s available to them, and take action with more context and reliability.

For a business leader, you don’t need to act on this today. But understanding that this is the direction the platform is building toward helps you ask better questions of your team, make smarter decisions about AI investment, and avoid being caught flat-footed when these capabilities become standard expectations.

Chatter Is on Its Way Out. Slack Is Moving In.

If your business has been using Salesforce for several years, Chatter has probably just always been there — the internal feed where your team can comment on records, tag colleagues, and share updates inside the platform.

Starting with this release, Chatter is disabled by default in all new Salesforce environments. Salesforce hasn’t announced a retirement date, and it’s not being turned off in existing orgs. But the direction is clear. New environments are automatically getting a Slack workspace instead, and Salesforce is building more and more functionality around Slack as its collaboration layer.

One concrete example from this release: users can now approve, comment on, and reject Salesforce approval requests directly from Slack, without ever opening Salesforce. That’s the kind of workflow improvement that makes Slack genuinely useful for teams that haven’t seen a reason to adopt it yet.

For businesses that are already on Salesforce but haven’t invested in Slack, the question isn’t whether this shift is coming. It’s whether your team will be ready for it or scrambling to catch up.

Where to Start This Week

If you take one thing from this release, it’s that the security changes need attention now. Have a conversation with whoever manages your Salesforce environment and ask two questions: are we ready for the MFA enforcement deadlines, and do the right people have the right level of access?

Those two questions will surface most of what needs to be addressed in the near term. On the AI and automation side, you don’t need to act on everything at once — but you do need to be intentional. Get your team together, understand what’s changing, and develop a plan that’s specific to your environment.

If you’re not sure where to start or what any of this means for your specific setup, that’s exactly what we help with. Listen to the full podcast episode here.

Related Resources

• Salesforce Is Enforcing MFA — And Your Business May Not Be Ready
• What AgentForce Actually Is — A Plain-Language Guide for Business Owners
• Chatter Is Going Away in Salesforce — Here’s What’s Replacing It
• Who Should Have Admin Access in Your Salesforce Org — And Why It Matters More Than Ever
• Salesforce Flow Updates That Actually Reduce Errors and Save Your Team Time