#Salesforce Developer375 debatiendo

We make outbound Apex callouts from a named credential to a vendor API. The vendor has moved that API onto a private cloud network, and our callouts now fail at the network layer before auth is ever evaluated. 

The only working solution we've found is for the vendor to allowlist Salesforce's published Hyperforce outbound ranges from https://ip-ranges.salesforce.com/ip-ranges.json (per KB 003876184, which explicitly recommends an IP allowlist for outbound Apex callouts since Salesforce outbound IPs may not resolve under *.salesforce.com). 

That works, but it has two drawbacks we'd like to avoid: the ranges are shared across all Salesforce tenants on that infrastructure, so it's a weak control rather than a real identity boundary and Salesforce advises allowlisting the entire file, which is a broad and evolving surface for the vendor's security team to accept. 

What I'm hoping someone has solved before-- 

1. Salesforce's stated preferred alternatives are mTLS and domain allowlisting, but both assume the far side is filtering at the application layer. When the block is network-level, a client certificate doesn't get you through the firewall. Has anyone actually used mTLS to solve a reachability problem rather than an auth one, or am I right that it's the wrong tool here?
2. Private Connect / Outbound Network Connection appears to be AWS PrivateLink only. Can anyone confirm whether Azure-hosted targets are supported, now or on the roadmap?
3. Is there any other mechanism to give an external endpoint a stable or narrower egress identity for Apex callouts?
4. For those who've hit this: did you end up putting a relay/gateway in front of the private service and pointing Salesforce at that instead? Would you recommend it?

Any experience appreciated, we have a go-live this week, so we're proceeding with the allowlist for now and looking for something more durable after. 

Articles that I have already read - 

1. https://help.salesforce.com/s/articleView?id=003876184&type=1

2. https://help.salesforce.com/s/articleView?id=000384438&type=1

#Salesforce Developer  #Architects  #Solution Architects  #TrailblazerCommunity  #Security  #Integration

***POLL IS CLOSED***

Lantern Astro won across every poll and will be the Winter ’27 Release logo!

_________ 

Help us choose the official Salesforce Winter ’27 Release logo.

Which character should star?

1️⃣ Agent Astro

2️⃣ Bookish Codey

3️⃣ Agent Appy

4️⃣ Lantern Astro

Cast your vote here, or vote in our polls on X, Instagram and LinkedIn (or all four!). 

🗳️ Voting closes Friday, July 10. The character with the most votes will become the official Salesforce Winter ’27 Release logo. 

Hello, 

Currently our system is built that upon the creation of a quote for a new sale they set a custom Contract Term field on the quote to the length they want the term to be (for example, 36) and then on the quote they set the Subscription Term to 12. They have automation that then creates a Master Agreement that is a high level agreement that contains the full length of the contract (for example, start date of 1/1/2026 through end date 12/31/2029) and on the master agreement the contract term says 36. And then there is a child agreement that is related to the master agreement (a child to this agreement) that has a contract term of 12 and a start date of 1/1/2026 through 12/31/2026. Then on 12/30/20206 they create a new Subscription Agreement via an auto renewal process for Year 2 with dates of 1/1/2027 through 12/31/2027. Then do the same thing at Year 3 for dates of 1/1/2028 through 12/31/2028. Then on 1/1/2029 they complete what is called a contract renewal where the above starts over again with a new master agreement then child subscription agreements. 

Now with a new sales they want to move to a quote with the custom contract term of 36 months and subscription term of 36 months but within the quote are quote line groups for Year 1, Year 2, Year 3 of 12 months. When the contract creates they want one contract containing the whole contracts information. Then at the end of the 3 years the "contract renewal" occurs for the 36 months for the contract term and Subscription Term. 

The issue is existing contracts on the old structure. How do we handle the interim subscription agreements before the contract renewal if we remove the master agreement. And then how do we move to the new contract renewal process at the end of the compete term. I am assuming some sort of data migration but not sure what that would be or would look like. 

Has anyone else had to go through this? And nope they do not want MDQ. 

Thank you. 

We are repeatedly hitting an internal error when deploying a Data Kit in Data Cloud. This has failed on every attempt across multiple deployment jobs over the last several hours and needs Salesforce engineering to investigate the internal error referenced in the error IDs below.

Data Kit:

Marketing Cloud Persnl pcom_prod Prfl Engmt Metadata Transfer 

pcom_prod_Prfl_Engmt_Metadata_Transfer 

Standard 

default 

Error message returned:

"DataKit Job Failed due to Internal Error. Please reach out to support team with ID: <error-id> (2028752298)"

Failed attempts and error/reference IDs:

Flow Interview       IDError                         IDTimestamp 

08Paj0000124XgU | 426789737-388962 | 9/3/2026, 6:17 PM 

08Paj0000123rBj | 1559381108-313628 | 9/3/2026, 6:25–6:26 PM 

08Paj0000124CgU | 508232336-307821 | 9/3/2026, 6:46–6:49 PM 

08Paj0000125hxA | 1402470654-5019 | 9/3/2026, 7:24–7:26 PM 

08Paj0000126vBn | 42186226-116822 | 9/3/2026, 10:33–10:34 PM

All failures reference the same trailing identifier (2028752298), which appears to be an org/consumer ID tied to the internal error.

Can someone tell me what could be the issue