Realm administrators can now require specific applications to use a sandbox for change management by forcing the sandbox feature ON in the Apps tab of the Admin Console. When enabled, all development for the specified app will be required to take place in a sandbox. App admins cannot disable the sandbox if forced on at the realm level.
For apps with the sandbox forced ON at the realm level, all options to disable the sandbox will be grayed out with a message that says "Sandbox has been enabled by the realm admin and cannot be disabled here. Work with your realm admin if you'd like to change this setting."
In order to no longer require a sandbox for an application, the realm admin will disable the sandbox at the realm level, which will allow the sandbox feature to be disabled in the application by the app admin. Sandbox control for any app, not enabled at the realm level, can still be enabled or disabled by the app admin(s).