Note: This release is in preview. Features described here don’t become generally available until the latest general availability date that Salesforce announces for this release. Before then, and where features are noted as beta, pilot, or developer preview, we can’t guarantee general availability within any particular time frame or at all. Make your purchase decisions only on the basis of generally available products and features.

Security and Identity

Preview Multi-Factor Authentication Assistant behavior before you deploy it. URL redirects and OAuth 2.0 flows are more secure and efficient. You can now update users’ email addresses more easily and securely. HTTPS is required for Salesforce domains, and enhanced domains meet browser security requirements. Encrypt the User Email field (beta). Learn more about API version use with the new API Total Usage event type. Security Center now integrates with Threat Detection (beta). For sites, improve page load times with caching and update guest user licenses.

Identity and Access Management
Identity and Access Management provides you with an upgraded version of the Multi-Factor Authentication Assistant, which includes a step that helps you preview multi-factor authentication (MFA) during your evaluation period. Other improvements include updates to OAuth 2.0 flows and connected app access to Customer Data Platform (CDP) ingest API services. And you can secure email address updates by requiring password resets. Customer 360 Identity provides extra customer protection with secure Embedded Login redirects and verification of email address updates. We‘re deprecating Identity Connect 2.1 and Identity Connect 3.0.1.2. You can upgrade to Identity Connect 7 when it’s released later this spring. In the Winter ‘22 release, Salesforce is increasing the length of one-time passwords to improve security.
Domains
Deploy a My Domain, and enable enhanced domains to meet the latest browser requirements. Improve Search Engine Optimization (SEO) by redirecting your site traffic to your custom domain. Secure HTTPS connections are enforced and HSTS preloading is recommended for your domains.
Salesforce Shield
Use the new Real-Time Event Monitoring Permission Set Event (generally available) to monitor permission changes and even make Transaction Security policies for user permissions. The APITotalUsage event log file type helps you track unused API versions. And the new USER_TYPE field helps identify if users associated with events are authenticated or guest users. Shield Platform Encryption now supports the User Email field (beta) and contact point fields.
Security Center
New date range fields on metric detail pages give you flexibility over which metric details you see at once. And Security Center now integrates with Event Monitoring Threat Detection (beta). You can see the total number of events per threat type, along with detailed information about each threat event without leaving the Security Center app. Threat event metrics update in near real time, offering you a more timely and complete view of your security posture.
Other Security Changes
Improve load times for authenticated site visitors through a new Visualforce page caching option. Update your site guest users to the latest license. Secure HTTPS connections are enforced for third-party domain connections, and you can decide what types of cookies are allowed on your Salesforce Sites.