Prepare for Global Login Changes — Salesforce Express Connect (SEC) Users and IP Allowlists Blocking Access to Hyperforce

First, ask your Salesforce Express Connect service provider whether they can resolve the global login changes to maintain uninterrupted connectivity, such as switching to AWS Direct Connect. If they can’t, to maintain uninterrupted connectivity, you must implement at least one of these three mitigation options by end of June 2026. If you don’t implement one of these options, you will lose access to the global endpoints, and login and authentication services using the global URLs will fail.

If you have already implemented any of these solutions, you don’t need to take any further action.

Option 1 (recommended): Upgrade to Hyperforce and Implement AWS DX

Hyperforce is Salesforce’s premiere infrastructure, delivering outstanding security, reliability, and availability to customers’ orgs.

Upgrading to Hyperforce and implementing AWS DX is a long-term solution for direct connectivity to Salesforce. Contact your account team to request a Hyperforce upgrade at any time.

Learn more about Hyperforce in these resources.

• Introducing Hyperforce - General Information and FAQ
• How to Prepare for an Org Migration
• Retain Uninterrupted Access to Salesforce Services on Hyperforce

Option 2: Transition to My Domain and Discontinue Use of TSC and LSC

To avoid impact on login services and continue using SEC, you can transition all use of login.salesforce.com and test.salesforce.com to your org’s My Domain URL. My Domain is available for all Salesforce orgs. To find the URL, from Setup, in the Quick Find box, enter My Domain, and then select My Domain Settings.

Note: If you are using internal or external applications to integrate with Salesforce that have hard-coded login.salesforce.com URLs, update these apps to use My Domain.

To identify where MyDomain is not yet in use, follow these steps:

• Check their login history to download a list of recent login data. Help article.
• Filter for records where the Login URL is login.salesforce.com.
• Work with the relevant application or service team to switch to their MyDomain. For SOAP/API applications, this article explains how to do it.

My Domain provides a number of benefits for customers. It offers improved performance and security while remaining compatible with a wide range of login functions.

Key Benefits

• Improved Performance: Direct My Domain connections avoid extra routing, which improves login performance.
• Enhanced Security: My Domain allows for the application of mTLS authentication and other connection features for stronger security.

Compatible Login and SSO Functions

Most login and SSO functions are compatible with My Domain. We recommend that customers verify if they are using any of the following with login.salesforce.com (LSC) or test.salesforce.com (TSC) and switch to My Domain where possible.

• Username and password logins
• SAML SSO with Salesforce as the Service Provider
• OAuth Endpoints
• OpenID Connect (OIDC) Token Subject in Identity URLs
• JSON Web Token (JWT) Key Retrieval from the JWKS /id/keys endpoint
• SOAP API Login
• Deprecated Legacy Portal Customer Logins, such as this
• Web-To-Case, Web-To-Lead, and Integrated Form Handlers for Web-To hostname

While My Domain offers many benefits, you might encounter some of the challenges listed above when you transition to it. We recommend that you start your analysis and migration work as soon as you can. If you find any blockers, implement AWS DX to unblock access.

Option 3: Add AWS Direct Connect (DX) Alongside SEC Before Login Traffic Transition

AWS Direct Connect (DX) is the direct connectivity solution for Hyperforce. To maintain direct access to Salesforce and related services, add AWS Direct Connect to your network before the login traffic transition begins.

We recommend this option if you require direct connectivity. This approach retains existing functionality and avoids the need for application-level changes. Adding AWS DX now prepares your org for an eventual upgrade to Hyperforce.

Benefits

• Works for all global endpoints migrating to Hyperforce, not just login.
• Prevents disruptions from future org migrations to Hyperforce.
• Proven to work for other SEC customers using both SEC and AWS DX.

Reference

• AWS Documentation: How to Access Salesforce Hyperforce Securely and Reliably with AWS Direct Connect
• Knowledge Article: Set Up AWS Direct Connect (DX) for Hyperforce

Functionality Related to Global Login Endpoint Access

As we migrate global login endpoints, it's important to be aware of the functionalities that require access, so that you can review their behavior and test your solution. If you don’t take any action, these functions could fail.

• Global Auth Providers: Global authentication providers for services such as Google, Facebook, and Microsoft use a global callback URL that requires login.salesforce.com (LSC) or test.salesforce.com (TSC). As an alternative, you can Define an Authentication Provider and switch to a My Domain URL for SSO requests.
• Login Hints: This feature requires global access to LSC/TSC to function. However, it’s not a login blocker and can be disabled if necessary.
• Custom Apps: Custom apps that use login.salesforce.com (LSC) or test.salesforce.com (TSC) for login and OAuth integrations will likely be affected. This includes integrations such as Canvas, Mobile, MailApp, Package Install, and Lightning and Image servlets.
• Undetected Clients: You might not be able to identify every client using the global endpoints. Prioritizing the adoption of AWS Direct Connect will help prevent unexpected connectivity issues.
• Application Updates: To make sure your integrations keep working and to retain existing functionality, you may need to update or reconfigure applications installed in your Salesforce organization(s) to use My Domain URLs instead of login.salesforce.com or test.salesforce.com.