> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps/oauth-faq.md). # OAuth FAQ ### What's the difference between Essentials and Advanced for OAuth? Material offers two OAuth tiers: * **Essentials** gives you real-time OAuth inventory, scope visibility, and account blast radius across connected apps. You can see which apps are connected, what scopes they have, and how many users are affected. Remediation remains manual. * **Advanced** includes everything in Essentials, plus the OAuth Remediation Agent. This adds investigation, classification suggestions, token revocation, end-user notifications, and recurring 90-day audits. **Which OAuth features require Advanced, and which are included in Essentials?** | Feature | Essentials | Advanced | | --------------------------------------------------------------------- | ---------- | -------- | | Real-time OAuth inventory | ✔️ | ✔️ | | Scope visibility and account blast radius | ✔️ | ✔️ | | **Application was granted OAuth access for the first time** detection | ✔️ | ✔️ | | Manual app classification and response | ✔️ | ✔️ | | AI-powered investigation (OAuth Remediation Agent) | | ✔️ | | End-user notifications (Slack) | | ✔️ | | Recurring 90-day OAuth audits | | ✔️ | ### Does Material automatically classify and revoke OAuth apps? Not yet. Here's how the current flow works: 1. When an app is investigated, Material suggests a classification. 2. Material does not assign that classification automatically. An admin must apply it manually or accept the suggestion. 3. The configured response runs only after a classification is applied. For example, if you apply **Malicious** and the default response is token revocation, revocation runs at that point. Review [OAuth Detections and Classification](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md) and [OAuth Remediation Responses](/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md) for more detail. We'll share future changes in release announcements and [What's New](/whats-new.md). ### I can see "Revoke token for all users" is configured in my settings. Is Material already revoking tokens? No. **Response by Classification** defines what runs when a classification is applied to an app. Nothing runs until that classification is set on a specific app. If an app already shows a classification in **Explorer** > **Apps** > **OAuth**, your team classified it manually and the response has already run. For unclassified apps, no response has fired. ### Is Material blocking apps from being installed in my environment? No. The OAuth Remediation Agent is detect-and-respond, not preventative blocking. Users can still install apps. Material detects new OAuth connections in real time, investigates them, and runs the configured response after an admin applies a classification. Apps authorized before the feature was enabled remain active until they are reviewed and classified. ### Why didn't my response fire after the agent investigated an app? Responses are triggered by classification, not investigation. The agent can investigate an app and suggest a classification, but the response runs only after a classification is applied. Check that: 1. You've applied a classification to the app, not just viewed the investigation or seen a suggestion. 2. A response is configured for that classification under **Settings** > **OAuth Apps** > **Response by Classification**. 3. The OAuth App Remediation setting is enabled in **Settings** > **Default Account Settings**. If all three are in place and the response still has not fired, contact support. ### Is there an API for OAuth app classification data? No. Material does not currently provide an API for OAuth app classification status. We'll announce availability in release notes and [What's New](/whats-new.md). ### Why does an app show as "Unclear" for App Behavior Risk? **Unclear** means the agent has no recorded runtime activity for the app yet. It does not mean the app is safe. This is common for newly connected apps or apps that have not been used since authorization. Treat **Unclear** as unknown until activity is recorded. Review [risk factors and classification](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md#classification) for more context. ### Can I stop responses from firing for specific users or service accounts? Yes. By default, accounts and groups inherit the global response settings. You can override this for specific accounts or groups. For example, you can exclude service accounts from automatic remediation or apply stricter settings to high-privilege users. See [Override remediation for an account or group](/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md#override-remediation-for-an-account-or-group). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps/oauth-faq.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.