Reminder: Complete ISC Salesforce Connector Migration to External Client App

Announcements Product News
, , ,
1

This is a reminder to Identity Security Cloud (ISC) customers still using Basic Authentication or Salesforce Connected App OAuth with the Salesforce connector (SaaS or VA).

ISC uses the SailPoint-published managed package ECA from Salesforce AppExchange, then Authorize on the source. This is not the IdentityIQ local ECA.

This follows prior ISC announcements on Compass:

Deadlines — federal vs non-federal

These dates are different. Federal availability does not change the commercial cutoff.

Customer environment ECA package Support cutoff for Basic Auth and Connected App
Non-federal (commercial) ISC Commercial SailPoint ECA on AppExchange — available 1 October 2026 (unchanged). Complete install + Authorize by this date.
Federal (FedRAMP) ISC Federal SailPoint ECA on AppExchange — will be released soon 1 December 2026. Do not use the 1 October commercial date. Start planning; migrate when the Federal package is listed.

Note for Identity Security Cloud on Alibaba Cloud

If your Identity Security Cloud tenant runs on Alibaba Cloud, do not install the SailPoint Salesforce External Client App from AppExchange. That managed package is not the supported path for this environment.

Use a local External Client App in your Salesforce org instead:

  1. Create a local ECA in Salesforce.

  2. Configure the local ECA with Client Credentials or JWT. Do not use Refresh Token.

  3. Contact SailPoint Support or your Customer Success Manager to enable local ECA authentication for your tenant. This path is not on by default.

Complete migration from Basic Auth and Connected App by the October 1st, 2026 commercial deadline. Include in the case that you are on Alibaba Cloud and need local ECA enabled for the Salesforce connector.

Why This Change?

Salesforce is replacing Connected Apps with External Client Apps (ECA) for third-party API access. Starting Spring ’26, customers cannot create new Connected Apps in the UI or API without Salesforce Support. ECA does not support username/password (Basic Auth).

SailPoint aligned the ISC Salesforce connector to a packaged ECA using OAuth 2.0 (Authorization Code / Authorize).

Action Required

Current configuration Non-federal action by October 1st, 2026 Federal action by December 1st, 2026
Basic Auth or Connected App OAuth Required now. Install the commercial SailPoint ECA from AppExchange and Authorize the source. Required after Federal ECA is released. Install the Federal package (not the commercial listing) and Authorize. Federal ECA will be released soon.
Already on commercial ECA (non-federal) with successful Test Connection and aggregation No further auth migration. Not applicable.
FedRAMP source still on Connected App / Basic Auth Not applicable — do not install the commercial package in FedRAMP. Wait for the Federal listing, then install + Authorize before December 1st, 2026.

What Happens if You Don’t Migrate?

Non-federal, after October 1st, 2026 / Federal, after December 1st, 2026:

  • Test Connection, account/entitlement aggregation, and provisioning will fail.

  • SailPoint Support will direct remaining Basic Auth / Connected App cases to complete ECA migration.

  • New Salesforce orgs and rebuilt sources cannot rely on Connected Apps.

What You Must Do Now

  1. Confirm environment. Commercial ISC vs FedRAMP. Deadlines and packages are not interchangeable.

  2. Non-federal: If you are not already on ECA, install the commercial SailPoint Salesforce ECA from AppExchange, Authorize the source, then Test Connection, aggregation, and a representative provision (if you provision). Repeat for every Salesforce org (production, sandbox).

  3. Federal: Do not install the commercial package. Watch for the Federal ECA listing (will be released soon), then install that package, Authorize, and validate before 1 December 2026.

Step-by-step for the package is in the availability announcement.

Help

If you are a non-federal customer already on commercial ECA with successful Test Connection and aggregation, you can ignore this reminder.

2

Cannot create new apps, does that mean existing apps can continue to be used rite

What if salesforce team has not migrated yet, still do we need to migrate ? Does SailPoint stop OAuth irrespective of whether customer Salesforce team migrated to ECA or not ?

3

Your idea may be right.

I agree