Version 1.51

Version 1.51 includes many improvements and fixes to enhance your in-app experience including detecting when calendars are configure to automatically accept meeting invitations, and a new and improved Integrations experience!

🥳 New

Calendar Auto-Detect

A new detection enabled by default now detects when a Google account is configured to automatically accept meeting invitations — a known social engineering and BEC tactic where attackers send invitations with malicious content, knowing they'll be accepted without review.

This is implemented in the detection: Google account automatically adds calendar invitations from everyone .

✨ Enhancements

Redesigned Integrations UI

The Integrations page now puts what you are integrating with front and center.

Native integrations contain recommended default events so you can connect, manage, and troubleshoot your third-party integrations more smoothly.

Don't see your tool on the list? No problem — use a custom integration.

Learn about all the Integration updates in our new Integration guides. We'll continue to add native integration documentation.

File searches and detections

Material has long supported detecting files shared with disposable email addresses (e.g., Temp-Mail or 10 Minute Mail). This release introduces a new search filter for this use case: shared.with_disposable_email.

The previous filter, shared.with_freemail, is still supported but is now deprecated. See the Deprecations section below for more details.

Disconnected domain notifications

In the unlikely event that an admin in one of your Google or Microsoft tenants accidentally revokes the basic access Material needs to function, we’ll let you know both in the Material UI with a more prominent notice and an automated Slack message. Opportunities to enable additional functionality by granting Material additional scopes will continue to surface in the Material UI.

API Tokens and Events Documentation Moved

API tokens and events documentation used to be under the API icon in the top toolbar. It's now located on the Integrations page (the puzzle icon):

---

🌇 Deprecations

Case Events

Beginning with version 1.51, we're retiring some legacy events:

• Existing subscriptions using the case events still work and you can still edit them
• case events can't be use for new subscriptions

Review the Case Event Migration Guide here for more details.

File Search Syntax

shared.with_freemail is deprecated and shouldn't be used for new detections or searches. Use shared.with_disposable_email or shared.with_personal_email, depending on your context.

---

🐛 Fixes

• Detection status toggle now persists reliably. Toggling a detection's enabled/disabled state was not always saving to the backend despite appearing to change in the UI. Configuration changes now take effect immediately.
• Custom branding setting hidden on shared instances. The Custom Branding for Outlook Add-ins setting was incorrectly visible on multi-tenant instances where it doesn't apply. Administrators on shared instances will no longer see it.
• Cleared issues no longer appear on the phishing simulation page. Issues linked to cleared issues were showing up on the simulations review page. The page now only surfaces active, relevant issues.
• Trusted entity recommendations are now domain-scoped. Recommendations were surfacing across all domains in a multi-domain org rather than being scoped to where the entity was observed. This reduces false positives and prevents inappropriate cross-domain trust relationships.
• Issue creation date is now accurate. Newly created issues could display an incorrect creation date. Timestamps now accurately reflect when the case was created.
• Google Drive analysis reliability improved. In certain scenarios, Drive file analysis could stall before completing. Analysis now completes reliably, restoring proper DLP and detection coverage for Drive content.