Introduction

Connected apps have historically played a key role in Salesforce integrations by enabling OAuth-based access for external systems. However, they have also become a frequent source of security risk when over-permissioned, poorly governed, or forgotten over time.

With the Spring ’26 preview release, Salesforce introduces a major security hardening change: the creation of new connected apps is disabled by default in all Salesforce orgs. This update strengthens default org security, reduces the attack surface, and accelerates the transition to External Client Apps as the preferred integration approach.

Important: This feature is in preview. Salesforce does not guarantee general availability. Make decisions based only on generally available features.

What’s Changing in Spring ’26?

Salesforce introduces a new default behavior for connected apps.

New Default Behavior

● Creation of new connected apps is disabled by default
● Existing connected apps continue to work normally
● Packaged connected apps deployed in new orgs are not affected

This is a security posture change, not a breaking change.

Why Salesforce Made This Change

Salesforce identified recurring security risks related to connected apps.

Connected apps are often:

● Over-permissioned
● Poorly governed
● Long-lived and forgotten

These characteristics make them attractive targets for attackers.

By contrast, External Client Apps provide:

● Improved OAuth security controls
● Better isolation between Salesforce and external systems
● Stronger lifecycle and governance management

This change nudges customers toward safer, modern integration patterns.

What Are External Client Apps?

External Client Apps are Salesforce’s modern replacement for connected apps.

They provide:

● Stronger OAuth security
● Clearer ownership and lifecycle management
● Reduced risk of credential misuse
● Better alignment with enterprise security practices

Salesforce recommends:

● Using External Client Apps for all new integrations
● Gradually migrating existing connected apps

What Is Not Affected

This change does not impact:

● Existing connected apps already in your org
● Connected apps deployed via managed packages
● Packaged connected apps installed from AppExchange
● Current integrations running in production

Your org continues to function without disruption.

Where This Change Applies

This security update applies to:

● Lightning Experience
● Salesforce Classic
● Salesforce Mobile App
● All Salesforce editions

This ensures consistent behavior across platforms.

What Changed in Setup?

Removed Setting

● Allow creation of connected apps
(Previously available under External Client App Settings)

New Default

● Creation of connected apps is disabled automatically

Can You Still Create a Connected App?

Yes, but only by exception.

To enable creation:

● Contact Salesforce Customer Support
● Request temporary enablement
● Provide business justification

Salesforce strongly recommends using External Client Apps instead.

Example Scenarios

Recommended Approach for New Integrations

● Use External Client Apps
● Follow modern OAuth and security best practices
● Simplify audits and governance

Legacy Integration Scenario

● Existing connected app continues to run
● Plan migration to an External Client App
● Reduce long-term security exposure

Best Practices Going Forward

● Stop creating new connected apps
● Inventory existing connected apps
● Identify unused or high-risk apps
● Migrate integrations to External Client Apps
● Limit OAuth permissions aggressively
● Review integration access regularly

Security and Governance Benefits

● Reduced attack surface
● Fewer misconfigured OAuth integrations
● Clearer ownership of integrations
● Easier audits and compliance
● Stronger default org security

Limitations and Notes

● Feature is in preview
● Governed by Salesforce preview and beta terms
● Enforcement details may evolve before GA
● GA timeline is not guaranteed

Who Should Care Most?

● Salesforce Administrators
● Security and compliance teams
● Integration architects
● Orgs with many third-party integrations
● Highly regulated industries

Conclusion

Disabling the creation of new connected apps by default is a significant security step in Salesforce Spring ’26. By guiding customers toward External Client Apps, Salesforce reduces risk, modernizes integration practices, and strengthens default security without breaking existing implementations.

For security-focused orgs, this preview feature is a clear signal to audit integrations, modernize OAuth usage, and future-proof integration governance.

Blogs

Creation of New Connected Apps Is Disabled by Default – Salesforce