⚠️🔒 Important Notice about Enhanced Protection for Your Field Service Mobile Data 🔒⚠️

Hello Trailblazers,

We’re enhancing security for the Salesforce Field Service mobile app to better protect your sign-in tokens—the credentials that keep your mobile workers securely connected to Salesforce. These updates help defend your data against unauthorized access, stolen tokens, and token replay. The security enhancements will roll out automatically, but preparing early will ensure uninterrupted service for your mobile workforce. Here’s what you need to know and how to prepare.

What’s Changing

Two key security features that will work together to protect your mobile data:

• Refresh Token Rotation (RTR): RTR issues a new sign-in token each time the app authenticates, ensuring that compromised tokens become invalid almost immediately. This feature is available in the Salesforce Field Service Mobile App v264.1 (Winter ‘27) and will be enforced on January 18, 2027. All user devices must be updated to v264.1 or later by this date. After this date, older versions will experience periodic logouts. Note: Because signing out clears local data from the device, any unsynced work will be permanently lost.

• 30-Day Idle Sign-In Limit: Idle sign-in tokens now expire after 30 days of inactivity. Salesforce automatically applies this setting via the Connected App configuration Limit Idle Refresh Token Time-to-Live (TTL) to 30 Days. As long as a device connects to Salesforce at least once every 30 days, the user remains signed in and the 30-day window resets.

Key Dates 

• October 14, 2026: Field Service v264.1 begins roll out to the Apple App Store and Google Play for device updates
• October 21, 2026: 30-day idle limit rollout begins for Sandbox orgs
• November 4, 2026: 30-day idle limit rollout begins for Production orgs
• January 18, 2027: Enforcement deadline to update to v264.1 or later

Important Considerations for Field Service Mobile

Because mobile workers frequently operate in offline environments, plan around the following behavior:

• Re-authentication clears unsynced data: If a device goes unused for more than 30 days, the user must log in again when reconnecting. Re-authenticating in the Field Service mobile app clears any unsynced data remaining on the device. Unsynced data cleared during re-authentication cannot be recovered.
• Best Practice: Ensure all mobile devices connect and sync at least once every 30 days. Instruct mobile workers to sync pending work prior to going offline for extended periods to ensure they don’t lose data.

Device Support and Next Steps

No device support is dropped in the v264 (Winter ‘27) release. Devices currently in active use require no hardware upgrades or special action for the idle limit. The simplest way to maintain peak performance and to keep your data protected is to keep your Field Service mobile app current.

Next Steps

Plan your mobile app update cycle following the release of v264.1 scheduled for October 14, 2026, and ensure all user devices are updated prior to the January 18, 2027 enforcement date.

Going Forward

Ensure all mobile devices connect and sync at least once every 30 days. Sign-in tokens will now expire after 30 days of inactivity. Unsynced data will be permanently lost.

Help and downloads

• Release note: Refresh Token Idle TTL Is Limited to 30 Days
• Release notes: Field Service Mobile Winter ‘27
• Download for iOS: Apple App Store
• Download for Android: Google Play Store
• Questions: Salesforce Support