7: Review OAuth Remediation Agent

Material monitors third-party app access in your Google Workspace environment in real time. Advanced plans include the OAuth Remediation Agent, which adds AI-powered investigation, automated classification, and recurring audits.

Two tiers of capability are available depending on your plan:

• Essentials: Real-time OAuth inventory, scope visibility, and account blast radius. The Application was granted OAuth access for the first time detection fires when a user connects a new app, creating an issue for review. You can manually classify apps and configure responses per classification, including token revocation.
• Advanced: Everything in Essentials, plus the OAuth Remediation Agent, which adds AI-powered investigation, automated classification (coming soon), end-user notifications, and recurring 90-day audits.

Learn more about OAuth Remediation in detail in the OAuth Security guides.

Take a moment during deployment to:

• Review app classifications
• Confirm default responses
• Enable end-user notifications if needed

---

Classify apps

App classifications drive response. You can manually classify any app from the Apps list, regardless of your plan.

On Advanced plans, the OAuth Remediation Agent investigates each app automatically, scoring it across four risk factors and providing a detailed report to inform your classification decision.

To view investigation details (Advanced):

1. Navigate to Explorer > Apps > OAuth.
2. Select an app to open the detail view.
3. Scroll to Latest Investigation for a summary, or click View full investigation for more details about the analysis.

How to classify an App

To classify apps and configure remediation and response you must have a Super Admin, Tenant Admin, Settings Admin, or Triage Admin role.

1. Navigate to Explorer > Apps > OAuth.
2. Select an app.
3. From the drop-down on the right, choose a classification. There are six classification types to assign to an app.

Auto-classification will be added in the future, stay tuned! We'll share more news in our release announcements and What's New.

---

Review default responses

Default responses trigger whenever an app is classified, whether the agent assigns the classification automatically or you apply it manually. Material pre-configures responses based on its recommendations. You can adjust them at any time:

1. From the left navigation, expand OAuth Security, then click Settings.
2. Scroll to Response by classification:

1. Select a response and save.

Learn more about responses, including manual response, here.

---

Set up end-user notifications

The agent can notify end users when an app they've tried to use is blocked or revoked. Notifications must be configured to use this response.

Slack

Send Slack direct messages to users when an app is classified as Unnecessary, Overprivileged, Suspicious or Malicious.

Connect Slack

Slack notifications require a Slack connection. If your workspace isn't connected, the OAuth Security > Settings page prompts you to connect it first:

Enable

1. From OAuth Security > Settings, scroll to End-user notifications.
2. Under Slack, toggle the setting On:

   

Preview

Notifications are pre-configured by Material. Malicious classification notifications are slightly different from the other classifications. You can preview notifications in the settings.

Preview the notification in settings

Email Notifications will be added in the future, stay tuned! We'll share more news in our release announcements and What's New.

---

Next Steps

Be sure to review the entire OAuth Security guides for more details.