> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/previous-releases/version-1.61.md).

# Version 1.61

Version 1.61 opens up much broader programmatic control of Material: you can now manage OAuth apps, connected agents, accounts, groups, and roles through the public API and MCP. It also brings higher-precision Google Drive detections for Advanced customers, faster detection creation, a redesigned Force Unlock, and a modernized API tokens table. It continues to expand built-in email threat coverage and includes a long list of fixes.

***

## :tada: New

### Manage OAuth apps, accounts, groups, and roles through the API and MCP

You can read and manage the core objects you work with day to day, both from your own scripts and from connected agents like Claude, ChatGPT, and Cursor.

New coverage in this release:

* **Accounts**: list and get accounts, update a single account, and bulk-update accounts
* **Groups**: list and get groups, list a group's members, and update groups individually or in bulk
* **Roles**: list roles, and assign roles by updating an account or a group
* **OAuth apps**: list and get apps, update an app's classification and remediation, list the accounts on an app, and revoke an account's grant
* **Issues**: the issues endpoint now returns each issue's detection description

All of these are available both as [API v1 endpoints](https://docs.material.security/reference) and as [MCP tools](https://docs.material.security/reference/material-mcp-server), so a connected agent can take the same actions your scripts can.

***

## ✨ Enhancements

### Detections and file security

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FO8Soie774x4UyRkTf8GH%2F2026-08-24_13-30-31%20(1).gif?alt=media&amp;token=dcdbb1fa-2346-4d74-b999-c7e0a8e5e1a7" alt=""><figcaption></figcaption></figure>

#### Save a plain-language file search as a detection

Prompt mode in [file search](https://docs.material.security/getting-started/fundamentals/explore/file-search) now supports **Save as detection**. Describe the files you want to look for in plain language, then save that search as a detection directly without rewriting it in MQL.

#### Auto-filled name and description when you create a detection

When you [create a detection](https://docs.material.security/getting-started/fundamentals/detect/custom-detections) from the **Detections** tab or from a search, Material now suggests a name and description automatically as soon as your query is valid.

You can save the detection without writing those by hand, and if you change the query the suggestion updates to match. This works for both file and message detections.

{% hint style="info" %}
Note, the generation populates after your successful query and only if no detection name or description has been entered yet.
{% endhint %}

#### Response column on the file detections list

The detections list now has a **Response** column that shows whether each detection has a response action configured, such as an email notification, a permissions change, or a label update.

A matching **Response** filter lets you narrow the list to detections that do or don't have a response set up.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2Fp39xP9OZJ0TbvmsVxhk8%2Fimage.png?alt=media&amp;token=025e76d9-ad7e-4170-8e25-edba0355d2b2" alt=""><figcaption></figcaption></figure>

#### Higher-precision Google Drive detections

Material's built-in Google Drive coverage now includes higher-precision detections that flag files in a sensitive category when they're shared externally or shared through a public link. Because they key off sensitive categories, these detections give you tighter default coverage on the Drive sharing that carries the most risk.

{% hint style="info" %}
These detections are available for customers with Advanced licenses.
{% endhint %}

#### Sensitive files header stays in view

On the [File Security report](https://docs.material.security/getting-started/deployment-guides/your-first-30-days/7-enable-file-security), the **Sensitive files by category** header now stays pinned as you scroll, so you always know which category a bar belongs to.

***

### OAuth apps and accounts

#### Filter the apps list by account

The apps list in Explorer has a new **Accounts** filter. Select one or more accounts to narrow the list to the OAuth apps those accounts have granted, including grants that were later revoked. CSV export respects the filter, so you can export exactly the apps you've filtered to.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FugBV0q1eKY90idSvOoji%2Fimage.png?alt=media&amp;token=b87ca5dd-5e0b-478d-a22e-e89addfbdc0e" alt=""><figcaption></figcaption></figure>

#### App name and date in CSV export filenames

When you export an app's account list to CSV, the filename now includes the app name and the export date, so exported files are easier to tell apart.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FbhS7Yvu07Dcy99z2RRN9%2Fimage.png?alt=media&amp;token=dd3f6391-2c60-464f-8b90-5227b237e966" alt="" width="309"><figcaption></figcaption></figure>

***

### Account takeover resilience

#### Redesigned Force Unlock

[Force Unlock](https://docs.material.security/learn-more/risk-areas/password-reset-protection/unlock-messages-for-end-users#method-2-force-unlock-messages) now opens as a cleaner two-column window:

* On the left: set the account, date range, and optional query criteria and preview the matching messages
* On the right: set the re-lock grace period and completion notification

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FlKwewwH6PvrNh0zV8Tnr%2Fimage.png?alt=media&amp;token=4861ad81-4f9b-4e90-9248-808cc7cc9615" alt=""><figcaption></figcaption></figure>

You now build the criteria with MQL, the same query language you use in Explorer and [custom detections](https://docs.material.security/getting-started/fundamentals/detect/custom-detections), in place of the previous free-text search. If needed, you can use the [quick prompt in the Explorer](https://docs.material.security/getting-started/fundamentals/explore) to build your query then copy and paste the MQL here.

{% hint style="info" %}
Learn more about [unlocking messages for end users](https://docs.material.security/learn-more/risk-areas/password-reset-protection/unlock-messages-for-end-users).
{% endhint %}

#### Broader password-reset and app-signup protection

Account takeover resilience now recognizes password-reset and app-signup emails from more services, so those messages are held and protected during a lockdown. New coverage in this release includes Box, Anthropic (Claude), Guusto, and Tango Card.

***

### Issues and investigation

#### A reworked command menu on issues

The command menu (⌘K) on email threat issues is easier to work in:

* Change an issue's response from the list or in batch, without opening each issue
* Classification labels are unified across the actions
* Priority actions are reordered
* Your saved views now have their own dedicated section

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2FBQiBYsCLLXlpdAbRVRPb%2Fimage.png?alt=media&amp;token=0f3710c1-d9e5-4bcb-8b18-a0f6c122906c" alt="" width="272"><figcaption></figcaption></figure>

#### Clearer classification and status wording

* The classification options in the command menu now use clearer, distinct colors so you can tell them apart at a glance.

<figure><img src="https://3411262179-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FksjM8NywYRSHu1IlfxdP%2Fuploads%2F3HTyzC4Pddkppdh27qZt%2Fimage.png?alt=media&amp;token=e6dfb9d5-8045-4b6b-b692-4397e4e33af8" alt="" width="159"><figcaption></figcaption></figure>

* When Material can't determine a classification, the banner on OAuth apps and user-reported email issues now says so plainly, instead of recommending an "unknown" classification that isn't actionable.

***

### Integrations and administration

#### Modernized API tokens table

The API tokens table (**Integrations** > **API** > **Tokens**) has been rebuilt to match Material's other tables, with search, links to each token's creator, role badges, an indicator for tokens created through an MCP connection, and a rename and delete flow.

#### Tenant details on every event payload

Every integration payload now includes a **tenant** block with the tenant's ID and display name. When you send events from more than one tenant into the same [SIEM or EDR](https://docs.material.security/learn-more/reference/event-subscriptions), you can tell which tenant each event came from.

For more details, navigate to Integrations > [API](https://docs.material.security/reference) or [MCP](https://docs.material.security/reference) > Events.

### Expanded email threat detection coverage

{% hint style="success" %}
New detection coverage rolls out continuously, independent of our release cycle. The items below are what's new since the previous release.
{% endhint %}

Material's built-in [email threat detections](https://docs.material.security/learn-more/risk-areas/email-threats/detect/) provide broader protection from email-based scams and malicious content, with no configuration required.

***

## 🐛 Fixes

#### Detections and file security

* The detections list now refreshes on its own after you create a detection, so a new detection shows up without a full page reload.
* Chart pivots in the File Security report no longer drop you into a broken, read-only search.
* Bars in the sensitive files by category chart now scale to the widest value in the section, so the comparison is accurate.
* Files owned by deleted Google accounts are no longer incorrectly flagged as shared externally, so your external-sharing views stay accurate.
* A disabled trusted entity no longer shows as trusted in file and report views.
* The Files view no longer shows a false "shared externally" badge while a file's trust information is still loading.

#### **Issues and investigation**

* Explanations on user-reported email issues now show the final classification reasoning, instead of an earlier version that didn't match the verdict.
* The messages table now aligns correctly on the issue evidence view.
* The suggested-response panel no longer appears when there's nothing to suggest.
* The Email Threats summary link for the largest change category now opens the right view.
* Searching message header fields that can hold more than one value, such as reply-to, works again.

#### **OAuth apps and accounts**

* The Apps Explore detail view no longer crashes when an app is missing some properties.
* An OAuth app's active-account count now stays accurate after you bulk-revoke grants.
* The **Last Activity** column on OAuth apps now sorts correctly and shows its "+" suffix again.
* The Accounts tab no longer crashes on instances that limit access by mailbox license.
* An OAuth app's Timeline now links directly to completed investigations.
* Issue-created events now carry the correct live app name for OAuth-app issues, instead of a missing or generic value.

#### **Platform and administration**

* The confirmation message after you create an API token no longer overlaps the success message.
* The Material logo no longer renders oversized in the footer of remediation notification emails, and a related two-line footer layout is fixed.

***

## :books: New and Updated Documentation

**Updated**

* [Hello World](https://docs.material.security/reference/api-v1/hello-world): The API v1 examples now include a Trusted Entities walkthrough, showing how to review what your instance already trusts, then add, retrieve, and update a trusted entity through the API and Material's MCP tools.
* [Auto-Respond](https://docs.material.security/learn-more/risk-areas/email-threats/auto-respond): Documents how Material remediates calendar invites, including soft-deleting and restoring an invite, and how to test the behavior before you roll it out.
* [Unlock Messages for End Users](https://docs.material.security/learn-more/risk-areas/password-reset-protection/unlock-messages-for-end-users): Adds guidance for password reset loops, explaining that Force Unlock doesn't deliver a password reset email that Material intercepted, and adds a method for getting that email to the user.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/whats-new/previous-releases/version-1.61.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.