Announcement: Salesforce External Client App is now Available

Announcements Product News
,
1

Following our initial advisory, this second announcement confirms that the SailPoint External Client App (ECA) package is now live on Salesforce AgentExchange. The ECA is now the only supported authentication method for the ISC Salesforce connector(VA and SaaS). The 90-day migration window opens July 1, 2026 use the time between now and then to install the ECA package, align your team, and validate in sandbox (available June 24)

Note : Do not migrate to ECA Authentication if you use the Salesforce Activity Data Insights (ADI) connector.

Why is this happening?

Salesforce is retiring its Connected App framework for external integrations and requires migration to External Client Apps (ECA). This is a Salesforce platform change, not a SailPoint product update. SailPoint has updated the ISC Salesforce connector to comply and published the ECA package on AgentExchange. You must complete migration by September 30, 2026 to maintain connectivity.

Key Dates

Plan your migration around these dates. Use the sandbox first to validate before production goes live.

Milestone Date
Sandbox availability June 24, 2026
Production availability June 29, 2026
Migration window opens July 1, 2026
Migration window closes September 30, 2026
Legacy auth permanently removed October 1, 2026

Deadline: September 30, 2026. After this date, Basic Auth and all OAuth 2.0 Connected App flows (JWT, Refresh Token, Client Credentials) are permanently removed. Connectors not migrated will lose Salesforce connectivity provisioning, aggregation, and all connector operations will fail.

What You Need to Do?

Install the SailPoint ECA package from Salesforce Agent Exchange and reconfigure your connector with ECA Authentication before September 30, 2026 ; connectors using deprecated authentication methods will stop working after that date.

What Is Changing?

Salesforce is replacing Connected Apps with External Client Apps for all external API integrations. The table below shows exactly what changes in the ISC Salesforce connector(VA and SaaS)

Area Before (Deprecated) After (Required)
Auth Framework Salesforce Connected App Salesforce External Client App (ECA)
OAuth Flow JWT / Refresh Token / Client Credentials / Basic OAuth 2.0 Authorization Code Grant only

Deprecated Authentication Methods

The following methods are deprecated as of July 01, 2026. They remain accessible via the backward compatibility toggle during the 90-day window. All deprecated methods and the legacy Connection Settings UI will be permanently removed on September 30, 2026.

Method Status Action Required By
Basic Authentication Deprecated September 30, 2026
OAuth 2.0 - JWT Bearer Deprecated September 30, 2026
OAuth 2.0 - Refresh Token Deprecated September 30, 2026
OAuth 2.0 - Client Credentials Deprecated September 30, 2026
External Client App (ECA) Supported — New Default —

Note: The backward compatibility toggle allows temporary reversion to a deprecated method if you encounter issues during migration. This toggle will be removed when the deprecation window closes and the deprecated connection settings UI will no longer be available.

Migration Steps

Complete all three steps by September 30, 2026

Step 1 - Install the External Client App Managed Package from Salesforce AgentExchange

  1. Go to the Salesforce AgentExchange.

  2. Search for the SailPoint ECA-SailPoint Identity Security for Salesforce

  3. Enter your Salesforce credentials to authorize the installation.

  4. Select Install for All Users (or your preferred security level) within your Salesforce organization.

Step 2 - Configure ECA Authentication in the ISC Salesforce Connector

In the Identity Security Cloud UI, open the Salesforce connector and go to the ECA Authentication section.

  1. Turn on the Enable External Client App (ECA) toggle.

  2. Under Client Configuration, add the following key-value pair:

    1. Key: host_name

    2. Value: Token URL for your environment — test.salesforce.com (sandbox) or login.salesforce.com (production), depending on your Salesforce tenant configuration

  3. Click on Authorize and complete the OAuth 2.0 Authorization Code Grant flow.

  4. Select Save.

  5. Review the configuration and select Test Connection to verify the integration.

Note: The service account used to authorize the ECA must have adequate permissions to manage the required Salesforce objects.

Step 3 - Validate and Move to production

  1. Run a test aggregation to confirm accounts and entitlements are returned correctly.

  2. Validate provisioning operations (create, update, disable) against a test account.

  3. Confirm lifecycle events are flowing as expected.

  4. Once validated, move to production

Important Considerations for ECA Authentication

  1. Maximum Concurrent Tokens

Salesforce limits active refresh tokens to five per user per External Client App. If a sixth connection is requested, Salesforce automatically and silently revokes the oldest active token. No warning is issued

  1. Revoked Token Reuse - Critical Risk

If an authenticated source attempts to authenticate using a previously revoked token (such as the silently dropped oldest token), Salesforce treats the attempt as a critical security threat. As a result, Salesforce immediately invalidates all active refresh tokens and sessions for that user across all clients.
Important: If this occurs, you must reauthorize the integration to continue. To avoid this scenario, ensure that no more than five concurrent authenticated connections are active per user for a given ECA.

  1. Backward Compatibility Toggle

A backward compatibility toggle is available in the connector UI during the 90-day deprecation window. This allows you to temporarily revert to a previously working legacy configuration if issues arise during migration. This toggle will be permanently removed when the window closes and will not be available post-deprecation.

Action Checklist

The migration window opens July 1, 2026. Start preparing now to avoid last-minute rush.

  1. Share this announcement with your Salesforce admin and identity governance team today.

  2. Align internally on ECA setup, AgentExchange installation approval, and test scheduling.

  3. Start in sandbox (available June 24) install the ECA package and validate before production goes live.

  4. Install the ECA package from Salesforce AgentExchange before July 1, 2026.

  5. Configure the connector with the correct host_name for each environment (sandbox and production).

  6. Complete validation in non-prod before promoting to production (available June 29).

  7. Use the backward compatibility toggle only as a temporary fallback not a substitute for migration.

  8. Contact your SailPoint PM or Customer Success Manager for migration support
    Deadline: September 30, 2026,

After this date, legacy authentication is permanently removed. Connectors not migrated will lose Salesforce connectivity provisioning, aggregation, and all connector operations will fail.

Support and Resources

  • Contact your SailPoint Product Manager or Customer Success Manager for migration support.
1 Like
Salesforce External Client App (ECA) Authentication – Clarification on Test Connection and Account Aggregation
Salesforce External Client App (ECA) Authentication - MFA Best Practices?
Salesforce ECA asking reauthenticate every time
Salesforce ECA need to be authorize many time
2

Hi there, you say this was supposed to be available as of yesterday, but we are not seeing this available to test yet?

3 Likes
3

Hi.

We can see the deprecation notice within the connector, but we still don’t see the option to enable ECA authentication. Is there another date set for this change?

Our client is asking us to connect to Salesforce, and we want to take advantage of this new method so we don’t have to set up the connection via OAuth 2.0, which will no longer be supported.

4

Hi.

Trying to configure a new Salesforce connector, but the ECA option is missing. Any idea when it will be available @Angel_Tawade?

1 Like
5

We also are trying to start this migration process but are not seeing the required config options in any ENV

1 Like
6

Hi Everyone,

I have enabled ECA authentication and completed all the required configuration steps:

  • Configured the host_name and corresponding value.
  • Successfully completed the Authorize process.
  • Verified in the Salesforce application logs that the authorization event was successful.

However, after performing a Test Connection, I noticed that the Salesforce logs show a Basic Authentication event instead of an ECA-based authentication event. Since ECA authentication is enabled and authorization has been completed successfully, I expected the authentication flow to use ECA.

My concern is that Test Connection and Account Aggregation operations still appear to be using the legacy/basic authentication mechanism rather than ECA.

Could you please clarify the following:

  1. Are Test Connection and Account Aggregation currently supported through ECA authentication?
  2. Do these operations continue to use the older authentication mechanism by design?
  3. Is any additional configuration required to ensure that all connector operations use ECA authentication?
7

Did you have to personally reach out to get the toggle to appear?

8

What is the workaround for clients that were connecting to Salesforce API’s via workflows?

9

Hello I have Salesforce set up as a Delimited Source File, I’m sure this won’t affect this set up… just making sure. Thanks

10

@Angel_Tawade After discussing this with our Salesforce admin, we had a couple questions arise:

  1. Is it possible to migrate our existing Salesfroce connected app to an ECA and use that for SailPoint to authenticate instead of using the SailPoint managed ECA?
  2. The SailPoint managed ECA’s OAuth and policy settings are hidden which is causing some concern. Can we get some transparency on these settings in the SailPoint managed ECA?
1 Like
11

@Angel_Tawade Is there any special configuration needed on the ECA from the Salesforce side? We have tried configuring our Salesforce connection using the ECA authentication and we enter the host name (Key) for our Salesforce tenant and the Salesforce OAuth token url (Value); but nothing works - the authorization fails.

12

Hi @Angel_Tawade , any update on these questions?

1 Like
13

Hello everyone,

I’m trying to better understand the OAuth flows for External Client Apps.

While testing the integration in the sandbox, I noticed that after entering the hostname and clicking Authorize, we’re redirected to the Authorization Code flow, where we have to manually authenticate through the Salesforce login page (SSO).

Is there a way to configure this integration to use the Client Credentials grant instead? If not, how secure is the current approach of being redirected to a login page over the internet to enter our credentials? Is this considered the recommended and secure authentication method for this type of integration?

I’d appreciate any clarification or best practices.

1 Like
14

@Angel_Tawade Same question as Brittany: how do you get to the Backward Compatibility Toggle to appear in the Source Setup UI? I can’t find it anywhere in Base Configuration, Connection Settings, ECA Authentication, Additional Settings, or Review and Test.

15

Hi,

We have setup the ECA authentication and test connection is successfully working.

but the issue is it gets frequently logged out after couple of days. and we have to authorize again.

Salesforce team told there is no expiration from there side.

Could you please advise why it is logging out.

Let me know if there is any thing needed from our side.

Thanks,
Usha

1 Like
16

Hi @USHA_RLA ,

We are also facing the same issue. Is it resolved for you? If yes, could you please let us know how to resolve this?

Thank you.

Shanmukh