> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/getting-started/deployment-guides/your-first-30-days/7-review-oauth-remediation-agent.md). # 7: Review OAuth Remediation Agent Material monitors third-party app access in your Google Workspace environment in real time. Advanced plans include the OAuth Remediation Agent, which adds AI-powered investigation, automated classification, and recurring audits. {% @arcade/embed url="" flowId="6mnKaEUsPNyiIZtRAEgg" %} Two tiers of capability are available depending on your plan: * **Essentials:** Real-time OAuth inventory, scope visibility, and account blast radius. The **Application was granted OAuth access for the first time** detection fires when a user connects a new app, creating an issue for review. You can manually classify apps and configure responses per classification, including token revocation. * **Advanced:** Everything in Essentials, plus the OAuth Remediation Agent, which adds AI-powered investigation, automated classification (coming soon), end-user notifications, and recurring 90-day audits. {% hint style="info" %} Learn more about OAuth Remediation in detail in the [Malicious OAuth Apps guides](/learn-more/risk-areas/malicious-oauth-apps.md). {% endhint %} Take a moment during deployment to: * [Review app classifications](#classify-apps) * [Confirm default responses](#review-default-responses) * [Enable end-user notifications if needed](#set-up-end-user-notifications) *** ## Classify apps App classifications drive response. You can manually classify any app from the Apps list, regardless of your plan. On Advanced plans, the OAuth Remediation Agent investigates each app automatically, scoring it across four risk factors and providing a detailed report to inform your [classification](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md#classification) decision. To view investigation details (Advanced): 1. Navigate to **Explorer** > **Apps** > **OAuth.** 2. Select an app to open the detail view. 3. Scroll to **Latest Investigation** for a summary, or click **View full investigation** for more details about the analysis.
#### How to classify an App {% hint style="info" %} To classify apps and configure remediation and response you must have a [Super Admin, Tenant Admin, Settings Admin, or Triage Admin role](/learn-more/administration/admin-roles.md). {% endhint %} 1. Navigate to **Explorer** > **Apps** > **OAuth**. 2. Select an app. 3. From the drop-down on the right, choose a classification. There are six [classification types](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md#classification-definitions) to assign to an app.
{% hint style="info" %} Auto-classification will be added in the future, stay tuned! We'll share more news in our release announcements and [What's New](/whats-new.md). {% endhint %} *** ## Review default responses [Default responses](/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md#default-responses) trigger whenever an app is classified, whether the agent assigns the classification automatically or you apply it manually. Material pre-configures responses based on its recommendations. You can adjust them at any time: 1. From the top toolbar, click **Settings** (the cog icon). 2. From the left navigation, click **OAuth Apps**. 3. Scroll to **Response by Classification**:
4. Select a response and **save**. {% hint style="info" %} Learn more about responses, including manual response, [here](/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md). {% endhint %} *** ## Set up end-user notifications The agent can notify end users when an app they've tried to use is blocked or revoked. Notifications must be configured to use this response. ### Slack Send Slack direct messages to users when an app is classified as Unnecessary, Overprivileged, Suspicious or Malicious. #### Connect Slack Slack notifications require a Slack connection. If your workspace isn't connected, the Settings screen will prompt you to connect it first:
#### Enable 1. From **Settings > OAuth Apps**, scroll to **End-user Notifications**. 2. Under **Slack**, toggle the setting **On**:
#### Preview Notifications are pre-configured by Material. Malicious classification notifications are slightly different from the other classifications. You can preview notifications in the settings.

Preview the notification in settings

{% hint style="info" %} Email Notifications will be added in the future, stay tuned! We'll share more news in our release announcements and [What's New](/whats-new.md). {% endhint %} *** ## Next Steps Be sure to review the entire [Malicious OAuth Apps guides](/learn-more/risk-areas/malicious-oauth-apps.md) for more details. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/getting-started/deployment-guides/your-first-30-days/7-review-oauth-remediation-agent.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.