Andrew Hanna
Tekunda Team
TL;DR: As of early September 2025, Salesforce began restricting access to uninstalled Connected Apps and removing OAuth 2.0 Device Flow from Data Loader. These security improvements require immediate action from admins to prevent disruptions to existing integrations.
This September, Salesforce introduced significant changes to Connected App security that are shifting this balance, and it's crucial you prepare now.
In recent months, a wave of voice-phishing (“vishing”) and social-engineering attacks has targeted Salesforce customers. Attackers posing as IT help-desk staff tricked employees into granting OAuth access to malicious apps and used those credentials to exfiltrate customer data.
High-profile victims include Google, where attackers stole business contact details and sales notes, as well as Chanel, Farmers Insurance and LVMH brands such as Louis Vuitton, Dior and Tiffany & Co. In the aviation sector, Air France and KLM disclosed in August 2025 that a compromised third-party customer-service platform exposed names, email addresses, phone numbers and loyalty-programme details.
These incidents underscore why Salesforce is tightening control over uninstalled connected apps and deprecating the OAuth Device Flow.
As Salesforce administrators, we walk a delicate balance between accessibility and security. We want our users to have the tools they need while keeping our organizations safe from threats.
The headline change is straightforward but impactful: uninstalled Connected Apps are no longer accessible to most users. If an app isn’t formally installed in your org, it’s blocked.
Here's what this means:
Salesforce has introduced new ways for trusted users to bypass these restrictions, but with added responsibility:
The effectiveness of these permissions depends on your org’s API Access Control settings.
On September 2, 2025, the OAuth Device Flow option for the auto-installed Data Loader app was removed entirely. Users must now switch to password authentication or OAuth Web Server Flow.
The answer is simple: security. Recent social engineering attacks have targeted Salesforce users, tricking them into authorizing malicious Connected Apps that masqueraded as legitimate tools like Data Loader. These attacks succeeded because they exploited the gap between user convenience and organizational control.
Security researchers note that groups such as ShinyHunters/UNC6040 conduct phone-based social-engineering to bypass multi-factor authentication and convince staff to approve OAuth scopes; once attackers obtain access, they quietly extract customer-care records and then use the data for extortion or further phishing.
As Google’s threat analysis revealed, attackers weren’t exploiting vulnerabilities in Salesforce itself, they were manipulating users into granting access to malicious apps. By defaulting to a “locked door” approach, Salesforce is forcing organizations to make deliberate decisions about which apps their users can access.
Immediate action required: Go to Setup → Connected Apps OAuth Usage and review every app in use.
Look for the “Install” button in the Actions column — if you see one, that app is uninstalled and affected by the new restrictions.
When reviewing, pay attention to:
For every uninstalled app you identify:
Audit, install, or block apps with a clear approval process. Use Serpent to track permissions and keep your org secure without slowing delivery.
Grant the “Approve Uninstalled Connected Apps” permission only when absolutely necessary. Suitable candidates might include:
⚠️ Remember: This is an all-or-nothing permission. Users with this permission can authorize any uninstalled Connected App, so choose wisely.
If your users rely on Data Loader:
If your users rely on Data Loader:
Use this transition as an opportunity to level up your Connected App governance:
Verify help-desk requests and limit third-party access: Many of the 2025 breaches began when attackers impersonated IT support and persuaded service-desk staff to grant or reset credentials. Require strict identity verification for any service-desk action, enforce multi-factor authentication on all accounts, audit third-party app scopes, and remove unused integrations. Regularly review connected apps and revoke long-lived tokens to minimise the blast radius if a third-party platform is compromised.
Let Tekunda design a security-first DevOps strategy tailored to your Salesforce setup, so you focus on business value while we handle governance.
The rollout began in late August and is continuing through September:
it is important to know that not everything is shifting. Here’s what stays the same:
While Salesforce is providing these new security controls, remember that platform security is a shared responsibility. The strongest technical controls can't protect against a user who's been socially engineered into granting access to a malicious app.
Use this transition to reinforce security awareness across your organization:
These updates show Salesforce’s commitment to closing security gaps while preserving the flexibility that makes the platform powerful. By putting these changes in the context of recent incidents, from Google and Chanel to Air France–KLM, you can see why restricting uninstalled apps and removing the OAuth Device Flow are necessary steps. Attackers are increasingly abusing trust and convenience; your governance and user education need to evolve just as quickly.
These changes give admins more control, but they also demand proactive preparation. By auditing Connected Apps, updating permissions, and training users, you’ll avoid disruptions and strengthen your security posture throughout the rollout.
Your users depend on you to keep the right doors open, and the wrong ones firmly shut. September’s changes give you the tools to do exactly that.
Looking for a simpler way to stay ahead of Salesforce changes? Serpent helps teams manage Connected Apps, streamline deployments and releases, and prepare for future updates with confidence.
Prefer to leave it up to us to manage your Salesforce org so you can focus on your
business stakeholders? Contact the Tekunda team today to
discuss a tailored security and DevOps strategy that keeps your organisation
compliant, resilient, and release-ready.
Andrew Hanna
Serpent Team
Tekunda Team
Tekunda Team
Tekunda Team
Andrew Hanna