> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md).

# OAuth Response

### Response

The OAuth Remediation Agent shares its investigation and analysis in issues based on the four OAuth Remediation detections. Two responses are available to take action on the issues:

* **Revoke token for all users** removes the OAuth access grant for every protected user who has connected the app, immediately terminating the app's access to their Google Workspace data. The app cannot reconnect unless a user re-authorizes it.
* [**Notify**](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/set-up-a-notification.md) **revoked users** sends a Slack direct message to each affected user when their token is revoked, letting them know the app has been blocked or removed.

{% hint style="success" %}

#### Configure your app classifications

Be sure you've [reviewed your app list and classified them](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md#classification) so that default responses can trigger appropriately.
{% endhint %}

### Default Responses

Default responses trigger whenever an app is classified — whether the agent assigns the classification automatically or you apply it manually. Material pre-configures responses based on its recommendations. You can adjust them at any time:

1. From the top toolbar, click **Settings** (the cog icon).
2. From the left navigation, click **OAuth Apps**.
3. Scroll to **Response by Classification**:

<figure><img src="/files/ZNYMetgQeJvkQ8gc3mmJ" alt="" width="563"><figcaption></figcaption></figure>

4. Select a response and save.

{% hint style="info" %}
To **Notify revoked users**, you need to [set up end-user notifications first](#set-up-end-user-notifications).
{% endhint %}

### Manual Response

You can manually update the response for a specific app, if it differs from how you would respond to that classification in general:

1. From the workspace, navigate to **Explorer** > **Apps** > **OAuth**.
2. Click an **App** to open the App Display view, then **add or remove responses** on the right:

<figure><img src="/files/PUWRfcQwA8fm5vxgRPWv" alt="" width="289"><figcaption></figcaption></figure>

#### Revoke a single user's token

To revoke access for one user without affecting everyone else connected to the same app:

1. Navigate to **Explorer** > **Apps** > **OAuth**.
2. Select an app, then click the **Accounts** tab.
3. Find the user's row, then from the row actions click **Revoke app token**.

<figure><img src="/files/ackE5YqlgP9q2hkBXYv5" alt=""><figcaption></figcaption></figure>

Confirming the action revokes that user's Google OAuth token, marks their row inactive, and records a revoke event on the app timeline. When end-user notifications are enabled, the timeline also records a **Notified user** event once the affected user has been told their access was revoked. Admin-initiated revocations are distinguishable from automated ones in the timeline, so you can tell them apart in an audit.

#### Revoke tokens for multiple accounts

To revoke access for several accounts at once:

1. Navigate to **Explorer** > **Apps** > **OAuth**.
2. Select an app, then click the **Accounts** tab.
3. Select the accounts you want, then click **Revoke app token** from the batch toolbar (or `⌘K`).

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FIkIKSQFyHKE3Q3RXlEKe%2Fimage.png?alt=media&#x26;token=69716719-da10-4965-ac97-8327962e9c60" alt="OAuth app Accounts tab showing controls to revoke tokens for selected accounts" width="321"><figcaption></figcaption></figure>

***

### Override remediation for an account or group

By default, accounts and groups inherit the global response settings. You can override this for specific accounts or groups, for example, to exclude service accounts from automatic remediation or apply stricter settings to high-privilege users.

1. From the workspace, navigate to **Explorer** > **Accounts (or Groups)**.
2. Select one or more rows.
3. From the bottom toolbar, click **Edit Settings**.
4. Scroll to **OAuth Remediation Agent**, then select **Override OAuth App Remediation** and toggle it **On**.

<figure><img src="/files/z3mQcQ6OG4l4h7ZUGWnI" alt="" width="373"><figcaption></figcaption></figure>

5. **Save**.

***

### Set up end-user notifications

The agent can notify end users when an app they've tried to use is blocked or revoked. Notifications must be configured to use this response.

#### Slack

Send Slack direct messages to users when an app is classified as Unnecessary, Overprivileged, Suspicious or Malicious.

#### Connect Slack

Slack notifications require a Slack connection. If your workspace isn't connected, the Settings screen will prompt you to connect it first:

<figure><img src="/files/38hAjgwmBtT9tReVVrd9" alt="" width="375"><figcaption></figcaption></figure>

#### Enable

1. From **Settings > OAuth Apps**, scroll to **End-user Notifications**.
2. Under **Slack**, toggle the setting **On**:

   <figure><img src="/files/1vzYPvVhoPOE8VlSh9su" alt="" width="375"><figcaption></figcaption></figure>

#### Preview

Notifications are pre-configured by Material. Malicious classification notifications are slightly different from the other classifications. You can preview notifications in the settings.

<figure><img src="/files/RtPlxgOrrtfCVppv84DP" alt="" width="375"><figcaption><p>Preview the notification in settings</p></figcaption></figure>

{% hint style="info" %}
Email Notifications will be added in the future, stay tuned! We'll share more news in our release announcements and [What's New](/whats-new.md).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/malicious-oauth-apps/oauth-remediation-responses.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.