> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.56.md). # Version 1.56 Version 1.56 brings a substantial expansion to the [OAuth Remediation Agent](/learn-more/risk-areas/malicious-oauth-apps.md), with more precise classifications, per-user token revocation, and a tighter triage experience throughout. This release also improves investigator workflows across issues, detections, and integrations, and fixes a batch of reliability issues in notifications, trusted entities, and multi-tenant views. *** ## :partying\_face: New ### New detection: Account clicked blocked content on a phishing message When a user clicks a defanged link or attachment on a message Material identified as a threat, without bypassing the warning, a new [**info-severity**](/getting-started/fundamentals/detect/detection-severity-framework.md) detection fires: **Account clicked blocked content on a phishing message**.
Detection details for Account clicked blocked content on a phishing message.

The new detection records when a protected phishing click is blocked before a user bypasses the warning.

This is distinct from the existing medium-severity detection (**Account clicked through speedbump on a phishing message**), which fires when a user *does* click through a speedbump to the actual potentially malicious destination. You get a low-noise, positive signal about protections that worked, separate from bypass events. Use it for awareness reporting or to track block effectiveness over time. This detection is enabled by default. Learn more about Material's [email threat detections](/learn-more/risk-areas/email-threats/detect/material-email-threat-detections.md) here. *** ## ✨ Enhancements ### OAuth Apps We recently released the [OAuth Remediation Agent](/learn-more/risk-areas/malicious-oauth-apps.md). This release we made a few enhancements and improvements: #### **Revoke a single user's app token** A new row-level **Revoke app token** action is available on the **App** > **Accounts** tab. Confirming the action: * Revokes that user's Google OAuth token * Marks their usage row inactive * Logs a distinct timeline event, so admin-initiated revocations are distinguishable from automated ones

From the Accounts tab, to the right of the account row click ... , then Revoke app token

You can now clean up a risky grant for one user without affecting everyone else connected to the same app. #### **Per-account OAuth scopes in the Accounts tab** The **Accounts** tab detail panel now shows **Scopes granted** badges per account, sourced from each user's OAuth token. Previously, scopes were visible only at the app level. When scopes differ between users, as they often do, you can now see exactly what each account authorized. #### **CSV export now respects your filters** The Apps CSV export now honors all active filters, including: * Verified, internal, scope level * Active accounts, classifications, and response state * Selected tenant
OAuth apps CSV export showing filters and export fields.

To download a CSV, from Explorer > Apps, click the download icon to the right of search.

It also exports the columns that matter for audit and review: client ID, website, scope-level fields, classification, suggested classification, response, account counts, and timestamps. Previously, the export ignored filters and used a legacy column set. #### **Internal apps now clearly labeled** Internal OAuth apps now clearly signal that no investigation will run: * An info callout explains that the OAuth Remediation Agent doesn't investigate internal apps. * An **Internal App** badge appears in the **Properties** card and on related issue details.
#### **Accepting a classification resolves the issue** Accepting the agent's [suggested classification](/learn-more/risk-areas/malicious-oauth-apps/oauth-detections-and-classification.md#how-to-classify-an-app) now automatically resolves the underlying issue. Previously, accepting a suggestion left the issue open, requiring a separate close action. #### **Navigation through app detail view** When you open an app from the apps list, you can now use the arrow buttons to move between apps without closing the overlay. This matches how you navigate through issues, detections, and accounts.
⭐ Other OAuth improvements * Apps without logos now show a generic icon, keeping app names left-aligned across the list. * OAuth audit and grant detection descriptions now use a consistent generic app icon plus a clickable app-name link. * The on/off toggle for Slack notifications now appears above the per-classification preview links in **Settings** > **OAuth Apps**. * Login-only apps are no longer incorrectly excluded from the new OAuth detection pipeline. * A duplicate investigation or issue is no longer created immediately after an admin manually classifies an app. * When the agent returns an Unknown classification, the investigation card now shows a warning callout asking you to choose a classification manually, instead of Accept/Reject buttons that had no useful effect.
*** ### Issues & Investigation #### **Email Threat issue sender reputation card loads faster** The **Sender reputation for…** card on [email threat issues](/learn-more/risk-areas/email-threats/investigate.md) now renders from lightweight issue data instead of waiting on a heavier data fetch. Sender reputation chips appear almost immediately when you open an issue.
#### **Timeline shows message removal counts and updates live** When multiple messages are removed from an issue: * The timeline shows a count (for example, "removed 7 messages") and collapses consecutive removals by the same actor into a single row. * The **Messages** tab badge, issue list message count column, and timeline suffixes all update live without a page refresh. #### **Assign to anyone from `⌘K`** Issue detail pages now include an **Assign to...** action under All Actions (`⌘K`), so you can search for an admin and assign the issue without leaving the page:
#### **CSV exports now include all recipients** Issue CSV exports now aggregate to/cc/bcc fields across all messages in the group rather than arbitrarily picking one message's values. Exports now faithfully represent who received the messages, which is important for incident response and reporting, especially when bcc is involved. *** ### Trusted Entities #### Email Threat settings in Add Trusted Sender The Add Trusted Sender [modal opened from a shared instance issue ](/getting-started/fundamentals/detect/trusted-entities.md#create-a-trusted-entity-directly-from-an-issue)now shows the Email Threat (Phishing) settings section, consistent with what dedicated instance admins see. Settings include: * Ignore phishing (email threat) reports * Ignore email authentication results * Skip reporter response
#### **VIP Designation consolidated into per-account flows** The dedicated Org Profile VIP Designation page has been removed. VIPs are now managed from the [Explorer](/getting-started/fundamentals/explore.md) in a couple ways: * A bulk **Suggested VIPs** banner that appears at the top of the Accounts page * The **Account details page**, Settings tab
Display-name variants are now fetched automatically and shown with an opt-out across all VIP-creation paths, giving you one consistent way to designate VIPs with less navigation. ### End-User Support page move The End-User Support page is now folded into **Organization Profile** in **Settings**. ### Richer Issue Change event payloads The Issue Change event subscription now includes details that were previously only available in the legacy "New Case Created" event ([deprecated](https://docs.material.security/reference/case-event-migration-version-1.51) in version 1.51). Webhook and event-stream integrations (Microsoft Teams, Slack, Splunk, etc.) can now build richer notifications without extra follow-up API calls. Details on these new fields are in the Events documentation in your Material instance under **Integrations** > **API and MCP** > **Events** > **Issues**: * **Message subject and recipients**: each message entity now carries `msgSubject` and the recipient lists `msgTo`, `msgCc`, and `msgBcc` (addresses only). * **Who/what flagged the issue:** a new detectedBy object reports the detection source: a Material user, an external reporter, a matched rule (with rule name and provenance), a user report (with reporting method), or a system/external alert — plus when it was flagged. This restores the "Detected By" information from the old caseCreated.mark field and adds per-message reporter detail. * **Sender reputation:** a new senderReputation object exposes: * `hasNovelSender` and `hasNovelDomain`, which indicate if any message in the issue has a novel sender or novel domain * The SPF/DKIM/DMARC results for the message that originally created the issue *** ## 🐛 Fixes * **ML signal badges in Message Explorer.** The Message Explorer's analysis column now shows ML signal badges like "Unsolicited Sender" and "Non-Freemail Sender," matching what you see in the message details view. You no longer have to open a message just to see these signals. * **Saving an OAuth Agent response no longer discards a pending classification suggestion.** Editing only the response on an app with a pending suggested classification, for example clicking **Revoke**, no longer implicitly rejects that suggestion. * **Slack magic sign-in emails** are now recognized and handled by [Account Takeover Resilience (ATOR)](/getting-started/fundamentals/account-takeover-resilience.md). * **Email-based integrations now support plus-sign addressing.** Previously, Material prevented configuring an email integration with plus-sign addressing (`user+suffix@example.com`) from delivery addresses. * **API docs in-product version clarity.** The version selector dropdown on the in-product API docs page has been replaced with a banner that indicates whether API v1 is enabled for your instance. See [API v1](https://docs.material.security/reference/api-v1/) for details or to request access to the preview release. * **Detection dropdown no longer capped at 10 results.** When creating an Event, the **Detection** dropdown now paginates with 50 results per page and supports scrolling. Previously, it showed only the first 10 typeahead matches with no scrollbar, requiring you to type the beginning of a detection name to find it. * **Mark Suspicious disabled on already-suspicious messages.** The `⌘K` > **Mark Suspicious** action is now disabled on messages already flagged suspicious, preventing a duplicate issue from being created. * **Objectives and tactics render again in message analysis.** A bug caused them to stop appearing. These labels help analysts understand the attack pattern behind a threat, so their absence could leave investigations without key context. * **Accepting recommended trusted entities no longer fails silently.** Validation now works correctly for these recommendations, and when an entity can't be added, you see a plain-language reason rather than a blank error. *** ## 🗑️ Removed * The **View Event Subscriptions** and **Create Event** buttons were removed from the in-product documentation on Events. Events are now associated with integrations. View and create Events from [**Integrations**](/integrations/integration-fundamentals.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/whats-new/previous-releases/version-1.56.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.