Enable Email Remediation

Now that you've configured Material Detections, User Reporting, Email Provider Alerts, and Issue Triage, you're ready to enable remediation. Enabling Email Threat Remediation grants Material permission to take action on detected threats.

The recommended approach is a phased rollout: enable for a small trial group first, validate, then enable for your whole organization.

Phishing simulations running? Update exempt IP addresses first.

If you have phishing simulations running in any tool, update your exempt IP addresses before enabling to avoid false positives on your simulations.

Enable for a trial group

Start with a small group, like your IT team or your own account, to confirm your configuration before rolling out org-wide.

1. As a super admin, log in to your Material instance.
2. From the left navigation, click Explorer.
3. Click Groups to enable for a group, or Accounts to enable for individual users.
4. Search for and open your trial group or account.
5. Click the Settings tab, then under Remediations, find Email Threat Remediation.
6. Select Override, then toggle it On.

After about a week, once you're satisfied with how remediation is behaving, proceed to enable globally.

Enable remediation globally

1. As a super admin, log in to your Material instance.
2. From the top toolbar, click Settings , then click Default Account Settings.
3. Under Remediations, toggle Email Threat Remediation to On.

Once enabled, Material remediates both newly detected threats and any issues identified before enablement.

(To disable Email Threat Protection: in step 3, toggle to Off.)

Manage remediation by group or user

After enabling globally, you can override the setting for specific groups or users. In Explorer, open the group or account, then click the Settings tab. Under Remediations, select Override for Email Threat Remediation, then toggle it Off. Select Inherit to restore the global setting.

---

Enable Email Bomb Protection

Optionally, enable Email Bomb Protection at this point. Material automatically detects email bomb attacks and remediates to restore inbox availability. You can choose to detect only, auto-remediate (enable), or do nothing (disabled). Learn more here.

---

You can return to Email Threats > Settings at any time to edit your response defaults and choices.

Email Security is now deployed! Next, enable Google Drive Security.