Salesforce Summer '22 Release Notes: New Security Features

Salesforce recently launched their Summer ‘22 release notes, highlighting a ton of exciting improvements and features for admins, developers and users alike. As always, the release promises to help organizations optimize, scale and succeed on the platform — and as you can imagine, there's a lot to sift through. 

Check out a few of our favorite features below. 

Salesforce Security and Privacy

Easier Multi-factor Authentication

As we previously reported, MFA has been enabled in every Org since Feb. 1st, 2022 — and it will be automatically enforced moving forward. To support this change, Salesforce has introduced a few new enhancements: 

• Users can now register WebAuthn (FIDO2) security keys as an MFA verification method
• Employees and customers can use their Microsoft credentials to log in to their accounts 
• Connected apps are more secure with Org-wide blocking for the OAuth 2.0 username-password flow

New Restriction Rules

Restriction rules no longer block access to records for users with View All or Modify All permissions for an object. Users with the permission View All or Modify All can now view all data, regardless of restriction rules, improving standardization across the overall permissioning structure.

Another big change to restriction rules is that they now cover external object records, making it possible to apply stricter controls over data stored outside your Salesforce Org.

Managing and Monitoring Permissions

The Summer ‘22 release comes with a few new permission and permission set enhancements to improve Org security and access control:

• You can now grant temporary access by creating permission set and permission set group assignments with an expiration date

• You can now create transaction security policies that block risky changes and monitor the assignment of critical user permissions

Securely Update Email Addresses and Resent Passwords

To ensure the security of your Org, users must now reset their password before changes to their email address and password become active. Previously, a user’s new email address became active as soon as they saved the change, allowing them to bypass an additional verification step. 

Preserve User Access to Personal Information Fields

Users with broad permissions such as View All Data and View All Users can no longer view personally identifiable information (PII). Users who need access to this information will need to be granted the new View Concealed Field Data permission.

Other Noteworthy Updates

Salesforce has introduced a few new features that allow for easier identification of excessive, inactive or duplicate data, specifically in picklists. Check them out below!

Get a List of Custom Picklist Fields with Inactive Values

This new feature is a great optimization and time-saving trick for your Admin. You can now get an email notification when custom picklist fields have more than 4,000 inactive values — previously, you would need to check each field for inactive values. Simply click “Email Me” on your Picklist Settings page to set up your email notifications.

Clean Up Inactive Picklist Values 

This new feature, which is available in Beta in the Summer '22 release, piggybacks off of the above enhancement — with it, you can now enforce limits on the number of inactive values for custom picklists and bulk delete any inactive values. 

Tip: To learn more about cleanup in Salesforce, click here. 

Learn Which Picklist Values Are Duplicates

Locating duplicate picklist values used to be a real pain — previously, Salesforce would alert you when you were adding duplicated, but it wouldn't specify which ones were the culprits. Now, you’ll receive a pop-up error message listing the duplicates when you hit save.

Of course, we’ve only scratched the surface of new enhancements available in your Salesforce Org. Check out the full release notes for a better understanding of the new rollouts and when they’ll be available to you.