Version 1.56

Version 1.56 brings a substantial expansion to the OAuth Remediation Agent, with more precise classifications, per-user token revocation, and a tighter triage experience throughout.

This release also improves investigator workflows across issues, detections, and integrations, and fixes a batch of reliability issues in notifications, trusted entities, and multi-tenant views.

---

🥳 New

New detection: Account clicked blocked content on a phishing message

When a user clicks a defanged link or attachment on a message Material identified as a threat, without bypassing the warning, a new info-severity detection fires: Account clicked blocked content on a phishing message.

The new detection records when a protected phishing click is blocked before a user bypasses the warning.

This is distinct from the existing medium-severity detection (Account clicked through speedbump on a phishing message), which fires when a user does click through a speedbump to the actual potentially malicious destination.

You get a low-noise, positive signal about protections that worked, separate from bypass events. Use it for awareness reporting or to track block effectiveness over time.

This detection is enabled by default. Learn more about Material's email threat detections here.

---

✨ Enhancements

OAuth Apps

We recently released the OAuth Remediation Agent. This release we made a few enhancements and improvements:

Revoke a single user's app token

A new row-level Revoke app token action is available on the App > Accounts tab. Confirming the action:

• Revokes that user's Google OAuth token
• Marks their usage row inactive
• Logs a distinct timeline event, so admin-initiated revocations are distinguishable from automated ones

From the Accounts tab, to the right of the account row click ... , then Revoke app token

You can now clean up a risky grant for one user without affecting everyone else connected to the same app.

Per-account OAuth scopes in the Accounts tab

The Accounts tab detail panel now shows Scopes granted badges per account, sourced from each user's OAuth token. Previously, scopes were visible only at the app level. When scopes differ between users, as they often do, you can now see exactly what each account authorized.

CSV export now respects your filters

The Apps CSV export now honors all active filters, including:

• Verified, internal, scope level
• Active accounts, classifications, and response state
• Selected tenant

To download a CSV, from Explorer > Apps, click the download icon to the right of search.

It also exports the columns that matter for audit and review: client ID, website, scope-level fields, classification, suggested classification, response, account counts, and timestamps. Previously, the export ignored filters and used a legacy column set.

Internal apps now clearly labeled

Internal OAuth apps now clearly signal that no investigation will run:

• An info callout explains that the OAuth Remediation Agent doesn't investigate internal apps.
• An Internal App badge appears in the Properties card and on related issue details.

Accepting a classification resolves the issue

Accepting the agent's suggested classification now automatically resolves the underlying issue. Previously, accepting a suggestion left the issue open, requiring a separate close action.

Navigation through app detail view

When you open an app from the apps list, you can now use the arrow buttons to move between apps without closing the overlay. This matches how you navigate through issues, detections, and accounts.

⭐ Other OAuth improvements

• Apps without logos now show a generic icon, keeping app names left-aligned across the list.
• OAuth audit and grant detection descriptions now use a consistent generic app icon plus a clickable app-name link.
• The on/off toggle for Slack notifications now appears above the per-classification preview links in Settings > OAuth Apps.
• Login-only apps are no longer incorrectly excluded from the new OAuth detection pipeline.
• A duplicate investigation or issue is no longer created immediately after an admin manually classifies an app.
• When the agent returns an Unknown classification, the investigation card now shows a warning callout asking you to choose a classification manually, instead of Accept/Reject buttons that had no useful effect.

---

Issues & Investigation

Email Threat issue sender reputation card loads faster

The Sender reputation for… card on email threat issues now renders from lightweight issue data instead of waiting on a heavier data fetch. Sender reputation chips appear almost immediately when you open an issue.

Timeline shows message removal counts and updates live

When multiple messages are removed from an issue:

• The timeline shows a count (for example, "removed 7 messages") and collapses consecutive removals by the same actor into a single row.
• The Messages tab badge, issue list message count column, and timeline suffixes all update live without a page refresh.

Assign to anyone from ⌘K

Issue detail pages now include an Assign to... action under All Actions (⌘K), so you can search for an admin and assign the issue without leaving the page:

CSV exports now include all recipients

Issue CSV exports now aggregate to/cc/bcc fields across all messages in the group rather than arbitrarily picking one message's values. Exports now faithfully represent who received the messages, which is important for incident response and reporting, especially when bcc is involved.

---

Trusted Entities

Email Threat settings in Add Trusted Sender

The Add Trusted Sender modal opened from a shared instance issue now shows the Email Threat (Phishing) settings section, consistent with what dedicated instance admins see. Settings include:

• Ignore phishing (email threat) reports
• Ignore email authentication results
• Skip reporter response

VIP Designation consolidated into per-account flows

The dedicated Org Profile VIP Designation page has been removed. VIPs are now managed from the Explorer in a couple ways:

• A bulk Suggested VIPs banner that appears at the top of the Accounts page
• The Account details page, Settings tab

Display-name variants are now fetched automatically and shown with an opt-out across all VIP-creation paths, giving you one consistent way to designate VIPs with less navigation.

End-User Support page move

The End-User Support page is now folded into Organization Profile in Settings.

Richer Issue Change event payloads

The Issue Change event subscription now includes details that were previously only available in the legacy "New Case Created" event (deprecated in version 1.51). Webhook and event-stream integrations (Microsoft Teams, Slack, Splunk, etc.) can now build richer notifications without extra follow-up API calls.

Details on these new fields are in the Events documentation in your Material instance under Integrations > API and MCP > Events > Issues:

• Message subject and recipients: each message entity now carries msgSubject and the recipient lists msgTo, msgCc, and msgBcc (addresses only).
• Who/what flagged the issue: a new detectedBy object reports the detection source: a Material user, an external reporter, a matched rule (with rule name and provenance), a user report (with reporting method), or a system/external alert — plus when it was flagged. This restores the "Detected By" information from the old caseCreated.mark field and adds per-message reporter detail.
• Sender reputation: a new senderReputation object exposes:

  • hasNovelSender and hasNovelDomain, which indicate if any message in the issue has a novel sender or novel domain
  • The SPF/DKIM/DMARC results for the message that originally created the issue

---

🐛 Fixes

• ML signal badges in Message Explorer. The Message Explorer's analysis column now shows ML signal badges like "Unsolicited Sender" and "Non-Freemail Sender," matching what you see in the message details view. You no longer have to open a message just to see these signals.
• Saving an OAuth Agent response no longer discards a pending classification suggestion. Editing only the response on an app with a pending suggested classification, for example clicking Revoke, no longer implicitly rejects that suggestion.
• Slack magic sign-in emails are now recognized and handled by Account Takeover Resilience (ATOR).
• Email-based integrations now support plus-sign addressing. Previously, Material prevented configuring an email integration with plus-sign addressing ([e-mail]) from delivery addresses.
• API docs in-product version clarity. The version selector dropdown on the in-product API docs page has been replaced with a banner that indicates whether API v1 is enabled for your instance. See API v1 for details or to request access to the preview release.
• Detection dropdown no longer capped at 10 results. When creating an Event, the Detection dropdown now paginates with 50 results per page and supports scrolling. Previously, it showed only the first 10 typeahead matches with no scrollbar, requiring you to type the beginning of a detection name to find it.
• Mark Suspicious disabled on already-suspicious messages. The ⌘K > Mark Suspicious action is now disabled on messages already flagged suspicious, preventing a duplicate issue from being created.
• Objectives and tactics render again in message analysis. A bug caused them to stop appearing. These labels help analysts understand the attack pattern behind a threat, so their absence could leave investigations without key context.
• Accepting recommended trusted entities no longer fails silently. Validation now works correctly for these recommendations, and when an entity can't be added, you see a plain-language reason rather than a blank error.

---

🗑️ Removed

• The View Event Subscriptions and Create Event buttons were removed from the in-product documentation on Events. Events are now associated with integrations. View and create Events from Integrations.