Version 1.61

Version 1.61 opens up much broader programmatic control of Material: you can now manage OAuth apps, connected agents, accounts, groups, and roles through the public API and MCP. It also brings higher-precision Google Drive detections for Advanced customers, faster detection creation, a redesigned Force Unlock, and a modernized API tokens table. It continues to expand built-in email threat coverage and includes a long list of fixes.

🎉 New

Manage OAuth apps, accounts, groups, and roles through the API and MCP

You can read and manage the core objects you work with day to day, both from your own scripts and from connected agents like Claude, ChatGPT, and Cursor.

New coverage in this release:

Accounts: list and get accounts, update a single account, and bulk-update accounts
Groups: list and get groups, list a group's members, and update groups individually or in bulk
Roles: list roles, and assign roles by updating an account or a group
OAuth apps: list and get apps, update an app's classification and remediation, list the accounts on an app, and revoke an account's grant
Issues: the issues endpoint now returns each issue's detection description

All of these are available both as API v1 endpoints and as MCP tools, so a connected agent can take the same actions your scripts can.

✨ Enhancements

Detections and file security

Save a plain-language file search as a detection

Prompt mode in file search now supports Save as detection. Describe the files you want to look for in plain language, then save that search as a detection directly without rewriting it in MQL.

Auto-filled name and description when you create a detection

When you create a detection from the Detections tab or from a search, Material now suggests a name and description automatically as soon as your query is valid.

You can save the detection without writing those by hand, and if you change the query the suggestion updates to match. This works for both file and message detections.

Note, the generation populates after your successful query and only if no detection name or description has been entered yet.

Response column on the file detections list

The detections list now has a Response column that shows whether each detection has a response action configured, such as an email notification, a permissions change, or a label update.

A matching Response filter lets you narrow the list to detections that do or don't have a response set up.

Higher-precision Google Drive detections

Material's built-in Google Drive coverage now includes higher-precision detections that flag files in a sensitive category when they're shared externally or shared through a public link. Because they key off sensitive categories, these detections give you tighter default coverage on the Drive sharing that carries the most risk.

These detections are available for customers with Advanced licenses.

Sensitive files header stays in view

On the File Security report, the Sensitive files by category header now stays pinned as you scroll, so you always know which category a bar belongs to.

OAuth apps and accounts

Filter the apps list by account

The apps list in Explorer has a new Accounts filter. Select one or more accounts to narrow the list to the OAuth apps those accounts have granted, including grants that were later revoked. CSV export respects the filter, so you can export exactly the apps you've filtered to.

App name and date in CSV export filenames

When you export an app's account list to CSV, the filename now includes the app name and the export date, so exported files are easier to tell apart.

Account takeover resilience

Redesigned Force Unlock

Force Unlock now opens as a cleaner two-column window:

On the left: set the account, date range, and optional query criteria and preview the matching messages
On the right: set the re-lock grace period and completion notification

You now build the criteria with MQL, the same query language you use in Explorer and custom detections, in place of the previous free-text search. If needed, you can use the quick prompt in the Explorer to build your query then copy and paste the MQL here.

Learn more about unlocking messages for end users.

Account takeover resilience now recognizes password-reset and app-signup emails from more services, so those messages are held and protected during a lockdown. New coverage in this release includes Box, Anthropic (Claude), Guusto, and Tango Card.

Issues and investigation

The command menu (⌘K) on email threat issues is easier to work in:

Change an issue's response from the list or in batch, without opening each issue
Classification labels are unified across the actions
Priority actions are reordered
Your saved views now have their own dedicated section

Clearer classification and status wording

The classification options in the command menu now use clearer, distinct colors so you can tell them apart at a glance.

When Material can't determine a classification, the banner on OAuth apps and user-reported email issues now says so plainly, instead of recommending an "unknown" classification that isn't actionable.

Integrations and administration

Modernized API tokens table

The API tokens table (Integrations > API > Tokens) has been rebuilt to match Material's other tables, with search, links to each token's creator, role badges, an indicator for tokens created through an MCP connection, and a rename and delete flow.

Tenant details on every event payload

Every integration payload now includes a tenant block with the tenant's ID and display name. When you send events from more than one tenant into the same SIEM or EDR, you can tell which tenant each event came from.

For more details, navigate to Integrations > API or MCP > Events.

Expanded email threat detection coverage

New detection coverage rolls out continuously, independent of our release cycle. The items below are what's new since the previous release.

Material's built-in email threat detections provide broader protection from email-based scams and malicious content, with no configuration required.