_edited.png){kind=small}
Agentforce Is Now On by Default in Winter ’27: What Salesforce Admins Should Check First
In 50 words: Salesforce is switching Agentforce on by default in Winter ’27 for eligible orgs, with the Setup toggle being removed. Nothing goes live automatically and Salesforce says there is no extra cost. Admins should check their Einstein setting, who can reach Agentforce Builder, existing permissions, and their governance plan.
If you open Setup this month and find Agentforce already switched on, you did not miss an email. Salesforce has made Agentforce on by default in Winter ’27 for every org with Agentforce access, and it has been rolling this out to existing orgs since early September. The Winter ’27 release itself became generally available on October 12, 2026.
That sounds more dramatic than it is, but it is nothing either. Turning the platform on is not the same as putting an agent in front of your customers, yet it does change who can build one. This guide explains what changed, what did not, and the six checks we recommend every admin runs first.
Table of Contents
What is changing in Winter ’27?
Until now, an admin had to switch the Agentforce platform on in Setup before anyone could build an agent. In Winter ’27, Salesforce removes that step. The Agentforce platform is enabled by default for every org with Agentforce access, as granted by its SKUs, licensing and edition.
Here is what is confirmed, based on Salesforce’s Winter ’27 release notes as reported by Salesforce Ben and other industry sources:
New orgs have Agentforce enabled at creation. Existing orgs are being enabled on a rolling basis, which began in the first week of September 2026.
It applies to orgs on Lightning Experience with Foundations on Enterprise, Performance, Unlimited and Developer Edition, and to orgs on Agentforce 1 Edition.
The Agentforce toggle on the Agentforce Agents page in Setup is being removed later in the Winter ’27 window.
Salesforce states that this comes at no additional cost and with no change to billing.
One caution on the last point. Salesforce has said more details will follow, as it did when Agentforce Coworker started appearing automatically for some customers in August. Confirm your own licensing position with your account team rather than relying on a general statement.
Why is Salesforce doing this?
Salesforce’s stated reason is simple: it wants building with Agentforce to feel more natural, with one less step between having a licence and building an agent. Removing a toggle is a small change, but it reflects a bigger direction. Agents are being treated as a standard part of the platform rather than an optional add-on.
It also follows a pattern. In August, Agentforce Coworker began appearing automatically for some customers on a rolling basis, and Salesforce handled that with a separate notice. Industry commentators have pointed out that it is not yet clear whether default enablement will increase the number of orgs actively using Agentforce. For admins, that uncertainty is a good reason to decide your own pace instead of letting the platform set it.
What “on by default” does and does not mean
This is the part most people get wrong. Auto-enabling the platform means the tools are available in your org. It does not mean an agent is running.
| Before Winter ’27 | After Winter ’27 |
Turning on the Agentforce platform | An admin switched it on in Setup | Done automatically for eligible orgs |
Setup toggle | Present on the Agentforce Agents page | Being removed later in the release |
Agentforce Builder access | After the admin enabled Agentforce | Immediate for admins if Einstein generative AI is enabled |
An agent talking to customers | Only after someone built and activated it | Still only after someone builds and activates it |
Extra cost | Per your licence | Salesforce says no additional cost or billing change |
The short version: the door is now unlocked by default. Nobody has walked through it unless your team builds and activates an agent. But if the door is unlocked, it is worth knowing who is standing near it.
6 things to check first
At Cloud Science Labs, we start every “AI is switching on” conversation the same way: find out what is already true in the org. These are the six checks, in the order we run them.
Find out whether Agentforce is already on.
Open Setup and look at the Agentforce Agents page. Because the rollout has been rolling since September, your org may already be enabled. Note the date you checked.
Check the Einstein generative AI setting.
This is the setting that decides how much changes for your team. If Einstein generative AI is enabled, admins get immediate access to Agentforce Builder. If it is off, Agentforce Builder access is not granted by default.
List who can build agents.
Admins get Builder access through the Einstein setting. Other users only get it if someone assigns them the Manage AI Agents permission. Review who holds it today and remove it where there is no clear reason.
Review permissions and data access.
An agent can only work with the data and actions it has been given access to, so overly broad permissions on profiles and permission sets become overly broad agent access. The same principle holds when Claude works inside Salesforce, as we explained in our Claudeforce guide. If your org has years of accumulated permission sets, this is the moment to review them. It is the check that matters most.
Inventory what already exists.
Check whether anyone has already built or tested an agent, including in a sandbox or developer org. Agents that nobody remembers creating are the ones that cause problems later.
Name an owner and write a one-page policy.
Decide who approves a new agent, who tests it, who monitors it and who can switch it off. If you work in a regulated industry, complete your internal AI review before anything is activated. A short written policy now saves a difficult conversation later.
If you would rather run these checks alongside people who do this every week, our Agentforce consulting team can walk through them with you.
Which controls you keep
Salesforce has said admins keep two main controls after the toggle goes:
The Einstein setting. Turning off the Einstein setting on the Einstein Setup page turns off the Agentforce platform.
Activate and deactivate. In Agentforce Builder, you can activate or deactivate any individual agent.
What goes away is the separate Agentforce toggle on the Agentforce Agents page. So if your plan is “leave Agentforce off until we are ready”, the Einstein setting becomes the switch to watch, and it is worth documenting who is allowed to change it.
Five mistakes to avoid
When a new AI capability switches on inside a live Salesforce org, the problems are rarely technical. They are usually about people and process. These are the five we see most often.
Assuming “off” means “safe.” If nobody has checked the Einstein setting or the Manage AI Agents permission, you do not know what is actually possible in your org.
Treating every admin as an agent builder. Admin rights were designed for configuration, not for deciding what an AI agent may say or do on behalf of the company. Decide who builds, separately from who administers.
Skipping the sandbox. An agent that looks fine in a demo can behave very differently against real records. Test against realistic data before anything is activated.
Having no owner. If nobody is named as responsible for an agent, nobody is watching it when it starts giving odd answers.
Ignoring data quality. Agents work from your records. Duplicates, missing fields and outdated values do not disappear when an agent reads them. They show up in its answers. Clean data is the most common reason Agentforce projects stall.
Should you act now or wait?
Not every org needs the same urgency. Here is a simple way to decide.
Act this month if:
Einstein generative AI is already on and many people hold admin rights.
You have a large, old permission model that nobody has reviewed recently.
You are in a regulated industry (healthcare, financial services, public sector) where AI use needs an internal sign-off.
You are planning to use Agentforce in the next two quarters.
You can schedule it for next quarter if:
Einstein generative AI is off and you have no plans to use it yet.
Your admin team is small and your permissions were reviewed recently.
Either way, do check 1 and 2 above now. They take minutes and tell you where you stand.
If you do not have the time or in-house skills to keep reviewing this, our Salesforce managed services can handle permission reviews and release checks on an ongoing basis.
A simple 30-day plan
If you want a practical way to turn the checklist into action, this is the plan we suggest to clients. Adjust the timing to the size of your org.
Week | Focus | Outcome |
1 | Run checks 1 to 3: is Agentforce on, what is the Einstein setting, who can build | A written snapshot of where you stand today |
2 | Review permission sets and profiles for users and anyone who might build agents | A list of permissions to tighten, with owners |
3 | Name an owner, write the one-page policy, inventory existing agents | A clear approval and monitoring process |
4 | Pick one low-risk use case, build it in a sandbox, test with realistic data | A decision on whether to go further, based on evidence |
When you test that first use case, decide in advance how you will judge the result. Our guide to measuring Agentforce ROI shows how to do that.
The aim is not to slow adoption. It is to make sure that when your first agent goes live, it does so on purpose and with the right people watching.
FAQ's
Does Agentforce being on by default cost extra?
Salesforce states that default enablement does not add cost or change billing. Agentforce usage and any add-on features are still governed by your own contract, so confirm your position with your Salesforce account team.
Will an agent start talking to my customers automatically?
No. Enabling the platform does not create or activate any agents. An agent only goes live after someone builds it and activates it in Agentforce Builder.
How do I turn Agentforce off?
Turn off the Einstein setting on the Einstein Setup page, which turns off the Agentforce platform. Individual agents can also be activated or deactivated in Agentforce Builder. The separate Agentforce toggle on the Agentforce Agents page is being removed during the Winter ’27 window.
Which orgs are affected?
Orgs with Agentforce access through their licences and editions: Foundations on Enterprise, Performance, Unlimited and Developer Edition, plus Agentforce 1 Edition. Check your own edition and entitlements, as access depends on them.
Who can build agents once it is switched on?
Admins get immediate access to Agentforce Builder if Einstein generative AI is enabled. Other users need the Manage AI Agents permission.
Conclusion
Agentforce on by default is a small change in Setup with a bigger meaning behind it. Salesforce is treating agents as a standard part of the platform, which means more of your team will see the tools sooner than they planned to. That is not a reason to worry. It is a reason to know your Einstein setting, your permissions and your owner before someone builds something you did not expect.
If you are weighing whether to bring in outside help, our guide to what Salesforce managed services include and cost explains the options. If you would rather have an experienced team check this for you, Cloud Science Labs can review your org’s Agentforce readiness, permission model and release impact as part of a Salesforce health check.
Prefer to talk first? Contact us, and we will point you to the right person.
Comments