Salesforce is making email address the default login prompt on its standard login pages — login.salesforce.com and test.salesforce.com. Username login is not going away: a "Login with Username" option stays on the page, and registered passkeys keep working with both methods. The change does not touch custom My Domain login pages or Experience Cloud login pages, and it applies to interactive UI logins only. Sandbox rollout began in late August 2026 and completes by September 30, 2026; production starts October 5, 2026, with most orgs migrated by early November. Admins have three jobs before then: tell users, audit shared or unmonitored mailboxes, and fix automated UI tests — the escape hatch is appending ?login=1 to the login URL.
?login=1 to the login URL (for example, https://login.salesforce.com/?login=1) to land directly on the username screen — the detail most coverage of this change will miss.When users open the standard Salesforce login pages at login.salesforce.com or test.salesforce.com, they are now asked for the email address associated with their account rather than their Salesforce username. Email login is the new primary default option on those pages.
Username login is not being retired. Anyone who prefers it — or whose username was never an email address — clicks "Login with Username" on the login page and signs in exactly as they do today. And if your org has rolled out passkeys, registered passkeys continue to work seamlessly with both login methods, so passkey users shouldn't notice friction either way. (If passkeys and MFA are still mid-rollout in your org, our Salesforce passkey and MFA admin guide covers the current state of play.)
The motivation is straightforward: people remember their email address. Salesforce usernames, by contrast, look like email addresses but aren't inboxes — and they accumulate suffixes across sandboxes and scratch orgs that nobody can recall under pressure. Anchoring the default prompt to an address the user actually monitors removes one of the most common "I can't log in" causes.
This is the most-asked question, and the answer is narrower than the headline suggests. The change applies to interactive UI logins through the standard login pages — login.salesforce.com and test.salesforce.com — and nothing else.
| Login path | Affected? | What happens |
|---|---|---|
| login.salesforce.com (browser) | Yes | Email becomes the default prompt; "Login with Username" stays available |
| test.salesforce.com (sandbox, browser) | Yes | Same behavior — rollout began late August 2026 |
| Custom My Domain login pages | No | Branded My Domain login pages are out of scope and unchanged |
| Experience Cloud login pages | No | Site and portal login pages are out of scope and unchanged |
| Passkey sign-in | No | Registered passkeys keep working with both login methods |
| API, OAuth, and integration logins | No | Non-interactive flows are untouched |
If your users always sign in through your My Domain URL, they may never see the new prompt at all. The teams that will notice are the ones whose users hit the generic login pages directly — and the admins whose automations do.
Salesforce's notice lists three preparation items. Here's what each one looks like in practice.
The failure mode here isn't technical — it's a help-desk spike the morning after your org migrates, when users see an unfamiliar screen and assume they've been phished or locked out. A short message ahead of time prevents most of it:
Send it before your production org migrates in October, and brief your help desk on the new screen so the first wave of tickets gets a confident answer instead of a password reset.
This is where orgs actually get bitten. Email-based login requires access to the incoming messages for that address. Any account registered to a shared inbox (sales@, support@), a distribution list, or a mailbox nobody monitors can fail at exactly the wrong moment — and these accounts are rarely on anyone's radar until they break.
Audit the usual suspects: service accounts, integration users that occasionally log in through the UI, legacy admin accounts, and contractor accounts from finished projects. For each one, either move it to a dedicated, monitored mailbox or deliberately keep it on username login via the "Login with Username" path. This is the same access-hygiene discipline we covered in our Salesforce security overhaul and email verification guide — if you did that review, you already have the list.
Any automated test that logs in through the Salesforce UI — Selenium, Playwright, Cypress, or similar — assumes the username-first screen. The moment email becomes the default, a test that types a username into the first field it finds will fail, usually with a cryptic timeout rather than an obvious error.
The username-first flow itself is unchanged: submit the username, click Log In, then enter the password. You have two ways to get your tests back onto it:
?login=1 to the login URL — for example, https://login.salesforce.com/?login=1. One URL change, no extra click step, and no dependency on link text that could shift.The ?login=1 parameter is the standout detail in Salesforce's notice and the one most write-ups of this change will skip. Bookmark it, put it in your test base URLs, and run your login-dependent suites in a sandbox this month while the rollout is still completing there.
| Environment | Rollout window | Status |
|---|---|---|
| Sandbox (test.salesforce.com) | Began late August 2026; expected complete by September 30, 2026 | In progress / completing |
| Production (login.salesforce.com) | Begins October 5, 2026; majority of orgs migrated by early November 2026 | Upcoming |
| My Domain custom login pages | Not in scope | No change |
| Experience Cloud login pages | Not in scope | No change |
The staggered schedule is your friend: sandboxes finish first, which gives you a live environment to validate user comms, shared-mailbox fixes, and UI test updates before production moves.
It's worth saying plainly: nothing about authentication strength changes here. Password policies, MFA requirements, session settings, and passkeys all work exactly as before. The only thing that changes is which identifier the first screen asks for.
If anything, the change nudges hygiene in the right direction. Anchoring login to an individual, monitored mailbox makes dormant shared accounts visible — and the audit in step 2 above is work most orgs owed themselves anyway. The real risk is operational, not cryptographic: forgotten mailboxes and brittle test suites. Both are fixable in an afternoon, which is exactly why the pre-October window matters.
Vantage Point helps organizations run Salesforce cleanly through exactly this kind of platform change — user communications, account and access audits, automation hardening, and the security reviews behind all of it. Through our Salesforce implementation and advisory services, senior consultants work alongside your admin team to close out the checklist before the October rollout reaches production. Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
Three short workstreams — user comms, mailbox audit, UI test updates — are all that stand between your org and an uneventful migration. If you'd like a second set of eyes on any of them, contact Vantage Point to schedule a session, or explore our Salesforce services to see how we support admins end to end.
No. Email becomes the default prompt on the standard login pages at login.salesforce.com and test.salesforce.com, but username login is not going away. Click "Login with Username" on the login page and sign in exactly as you do today.
No. The change applies only to UI logins through the standard login pages at login.salesforce.com and test.salesforce.com. Custom My Domain login pages and Experience Cloud login pages are not affected, and neither are non-interactive flows such as API and OAuth logins.
Yes. Registered passkeys continue to work seamlessly with both login methods. Users who already sign in with a passkey should not notice any difference.
Email-based login requires access to the incoming messages for that address. An account tied to a shared inbox, a distribution list, or a mailbox nobody monitors can fail at exactly the wrong moment. Audit service and legacy accounts now, and give each one a dedicated, monitored mailbox — or keep it on username login.
Either have the test click "Login with Username" before entering credentials, or point it straight at the username screen by appending ?login=1 to the login URL, for example https://login.salesforce.com/?login=1. The username-first flow itself is unchanged: submit the username, click Log In, then enter the password.
Production rollout begins October 5, 2026, and Salesforce expects the majority of orgs to be migrated by early November 2026. Sandbox rollout began in late August 2026 and is expected to complete by September 30, 2026, so validate anything that depends on the login screen in a sandbox first.
No. Only the identifier on the first screen changes — password policies, MFA requirements, and passkeys all work exactly as before. The real risk is operational: forgotten shared mailboxes and brittle UI tests, both of which are fixable this month.
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI — 150+ clients, 400+ engagements, and a 4.71/5 average engagement rating. Learn more at vantagepoint.io.