Version 1.59
Version 1.59 brings programmatic control of Trusted Entities through the public API, file search in plain language, faster OAuth app account management, and broader built-in email threat coverage. It also sharpens issue investigation with related-issue surfacing and clearer, local-time timelines.
🎉 New
Manage Trusted Entities programmatically
You can now manage Trusted Entities programmatically through the public v1 API and Material's MCP tools, not just in the UI. You can list, create, update, delete, and bulk-manage trusted senders and domains, with a bulk endpoint that handles up to 200 entries in a single request.
Search files in plain language
MQL is no longer the only way to search for files in the Explorer. File search now has three modes, chosen with Search Mode at the top of Explorer > Files:
Quick: a form-based search
Prompt: describe your search in plain English
Query: the full MQL search
✨ Enhancements
Expanded detection coverage
Material's built-in email threat detections catch more real-world attacks since the previous release, with no configuration required. New coverage is added automatically, so you don't need to create or turn on anything.
New built-in coverage
Material now automatically flags more attack types, including:
Netflix impersonation lures
Voicemail-notification lures that carry credential phishing and come from newly registered sender domains, added after catching a live campaign
SVG image attachments used to hide external links
Suspicious Flowcode QR code and redirect links
File-share links that carry suspicious HTML content, a common way to disguise a credential-phishing page as a shared file
Sharpened coverage for active campaigns
Coverage for Xero-themed infrastructure abuse now matches more variants, including job-offer and hiring lures
Coverage for a Zoom document-sharing infrastructure-abuse campaign was tuned repeatedly to keep pace as the campaign evolved
Issues and investigation
View related issues when a message matches more than one detection
When a message matches more than one detection (for example, if you have overlapping custom detections), the issue detail view displays the primary detection that created the issue and notes the additional match:
The detection detail view for the second detection that also matched now displays the primary detection's issues as related issues:
Local time by default in timelines
The message, app, issues and Trusted Entities timelines now show timestamps in your local time by default, so events are easier to read at a glance.
To switch, click Preferences on the timeline, then under Date format choose UTC:
OAuth Apps
Redesigned Accounts tab with bulk token revoke
The Accounts tab on an app's detail view now opens filtered to active accounts, with a count that matches what's shown:
New Remediation and Scope Level columns and filters let you sort and narrow the list, and you can select multiple accounts to revoke their tokens at once, from the row menu, the batch toolbar, or ⌘K:
Export app account lists to CSV
You can now export the per-app Accounts list to a CSV file, for both OAuth apps and Email Verification apps, up to 20,000 rows. The export also includes an All Scopes column listing every scope ever granted to an app, instead of only a risk summary.
Simplified Accounts tab for Email Verification apps
Email Verification apps now have a dedicated Accounts tab that shows only the fields relevant to them, instead of the fuller OAuth-oriented tab.
Files
Find files shared externally to a trusted entity
File search can now match files shared externally to a trusted entity separately from files shared externally in general.
In Quick search, select the new Trusted external filter
In Query search, use the
shared.with_trusted_entityoperator. It's a new operator, so your existing saved searches keep working unchanged.
Administration
Usage report: the Account Settings and Admin Activity areas now appear as visually distinct sections instead of blending together, and the "Explore more reports" section has been removed.
Reports > Usage Integrations shortcuts: ⌘K now mirrors the integration action buttons.
From the Integrations list, you can Create integration.
With an integration open, ⌘K also offers Save, Enable or Disable, and Delete for that integration.
🐛 Fixes
Issues and investigation
Message timelines now sort correctly even when a message is missing a date.
Opening the Issues table from the Overview now keeps the sort order you were using.
Stale accept or reject classification actions no longer linger in ⌘K after you've acted on them.
Restricted-content searches now show a clear, actionable error instead of "unknown attribute".
The border around the message header explanation is now visible in dark mode.
OAuth Apps
OAuth app investigations no longer crash for tenants that don't have a primary domain set.
After you accept or reject an OAuth app's suggested classification, the Accept/Reject suggested classification commands no longer linger in ⌘K.
The classification recommendation callout on an OAuth app now dismisses after you accept it, instead of staying visible.
OAuth app investigation reports now render with proper line breaks and formatting, instead of showing raw characters like
\nand###.
Detections
Fixed the cursor jumping to the start of the line while you type in the custom detection query editor, so you can edit longer queries without losing your place.
Platform and administration
The Accounts CSV export in Explorer is no longer empty when a License or Active Features filter is applied.
Lists that load one page at a time, such as the OAuth app Accounts tab and the Simulation enrolled-users list, no longer jump back to the first page when you reload.
The read-only remediation window no longer shows its option cards as clickable when they can't be changed.
Fixed a Google sign-in crash for users on newly enrolled domains
SAML login now falls back correctly instead of misreading details left over from an earlier sign-in attempt
Fixed an internal error that could affect API availability
Fixed a crash when switching tabs in areas that share the same tabbed layout, including Trusted Entities settings, the account and mailbox message view, Detection Details, and Reports
Audit events for viewing an issue are now visible to admins scoped to a specific domain, not only to global-scope admins.
📚 New and Updated Documentation
New
Configure Google Workspace security settings: New deployment-guide page covering the built-in Google Workspace controls to turn on alongside Material, including enhanced pre-delivery message scanning, advanced phishing and malware protection, and custom spam filters.
Updated
Configure VIP Impersonation & Trusted Entities, VIP Impersonation, and Identity Integrations: Corrected the VIP setup steps and clarified identity integration naming.
Enable Sensitive Email Redaction: Clarified the force-unlock use case and the requirement to include Material in your employee off-boarding process.
Last updated
Was this helpful?