Introduction

Connected apps are essential for integrations, automation, and third-party tools. However, they can also become a security risk if access is not properly governed. Until now, Salesforce automatically blocked attempts to use uninstalled connected apps, but administrators had little visibility into who was blocked or why.

With the Spring ’26 preview release, Salesforce introduces a new security visibility feature that allows admins to track denied attempts to use uninstalled connected apps. This enhancement helps distinguish between legitimate integration failures and suspicious or malicious access attempts.

Important: This feature is in preview. Salesforce does not guarantee general availability. Make decisions based only on generally available features.

What’s New in Spring ’26?

Salesforce now logs and displays information about denied attempts to use uninstalled connected apps.

New visibility includes:

● Logged denied attempts for uninstalled connected apps
● Timestamp of the most recent denied attempt
● Aggregated visibility directly in Setup

This replaces silent failures with actionable security insights.

What Are Uninstalled Connected Apps?

An uninstalled connected app is:

● A connected app that is not installed in your org
● Attempted to be used through OAuth or API access
● Automatically denied by Salesforce for security reasons

Only users with the Approve Uninstalled Connected Apps permission can bypass this restriction. This permission should be limited to highly trusted administrators.

Why This Feature Matters

Before Spring ’26:

● Denied attempts occurred silently
● Users were unaware of why integrations failed
● Admins had limited visibility into suspicious activity

With this enhancement:

● Denied attempts are clearly visible
● Integration issues can be diagnosed faster
● Potential security threats are easier to detect
● Access governance is significantly improved

Key Security Scenarios This Solves

Legitimate Integration Issue

● A user attempts to use a trusted third-party tool
● The connected app is not installed
● Access is denied
● Admin sees the denied attempt in Setup
● Admin installs the app
● Integration works securely

Suspicious Activity

● An unknown connected app attempts OAuth access
● Access is denied automatically
● Admin sees repeated denied attempts
● Admin blocks the connected app
● All active sessions are terminated
● Future access is prevented

Where This Feature Applies

This feature applies to:

● Lightning Experience
● Salesforce Classic
● OAuth-based connected app access

Additional notes:

● Available in all editions
● Not available in all orgs during preview

How to View Denied Attempts (Demo)

● Go to Setup
● Search for Connected Apps
● Open Connected Apps OAuth Usage
● Review the new columns:
● Denied Attempts Due to Usage Restriction
● Last Denied Attempt Due to Usage Restriction

These columns show how often and how recently an uninstalled connected app was blocked.

What Actions Can Admins Take?

Based on the information shown, admins can:

● Install the connected app if it is legitimate
● Block the connected app if it is suspicious
● End all active sessions for that app
● Prevent future usage, even by trusted users

Blocking an app enforces the highest level of protection.

Best Practices

● Review Connected Apps OAuth Usage regularly
● Restrict the Approve Uninstalled Connected Apps permission
● Install apps only from trusted vendors
● Block apps with repeated suspicious attempts
● Include this data in security audits and reviews

Limitations and Notes

● Feature is in preview
● Governed by Salesforce preview and beta terms
● Not available in all orgs yet
● Behavior may evolve before GA

Who Benefits the Most?

● Salesforce Administrators
● Security and compliance teams
● Orgs with many integrations
● Enterprises with strict access controls
● Highly regulated industries

Conclusion

The ability to track denied attempts to use uninstalled connected apps is a significant improvement in Salesforce security visibility. With this Spring ’26 preview feature, administrators can quickly resolve legitimate integration issues while proactively detecting and blocking potential threats.

For any org that values secure integrations and strong governance, this enhancement is an important feature to monitor and adopt early.

Blogs

Track Attempts to Use Uninstalled Connected Apps

Categories