Improve Security by Requiring User Access to Apex Classes Invoked by Flow (Critical Update)

This critical update requires a user running a flow to have access to all Apex classes invoked by that flow. If a flow invokes Apex, the running user must have the corresponding Apex class assignment in their profile or permission set.

Where: This change applies to Lightning Experience and Salesforce Classic in Essentials, Professional, Enterprise, Performance, Unlimited, and Developer editions. This change applies only to flows executed in Lightning runtime.

When: This critical update begins auto-activating on December 2, 2019.

How: From Setup, enter Critical Updates in the Quick Find box. Then select Critical Updates. For Require User Access to Apex Classes Invoked by Flow, click Activate.

Admins might need to adjust profiles or permission sets for users who run flows that invoke Apex classes. A flow stops working if it invokes an Apex class that the running user doesn’t have access to.