> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/whats-new/version-1.64.md). # Version 1.64 Version 1.64 helps you act on open issues and investigate OAuth apps. You can now: * [Apply updated Google Drive detection responses to open issues](#apply-an-edited-response-to-open-google-drive-issues) * [Enable OAuth app auto-classification](#enable-oauth-app-auto-classification) * [Export detections to CSV](#export-your-detections-to-csv) * [Review smarter VIP suggestions](#smarter-suggested-vips) OAuth app investigations also include the sources behind their conclusions. This release also adds clearer [Identity Protection notices](#clearer-notices-when-a-message-is-held-or-blocked) for held or blocked messages. It adds tenant names across Global view and standard rate-limit responses for the Message Search API and Material MCP server. Read to the end for a [sneak peek](#coming-soon) of some upcoming changes too! *** ## ✨ Enhancements ### Apply an edited response to open Google Drive issues When you change the response on a Google Drive detection, you can now apply the new response retroactively to the issues that detection has already opened, not just to future ones.
Response settings for a Google Drive detection, with an option to apply the updated response to open issues.

Apply an updated Google Drive detection response to open issues.

After you update the detection response, click **Save**, then choose whether to apply it to open issues. * The response applies to the detection's **Open**, **In Progress**, and **Snoozed** issues. Ignored issues aren't affected. * Steps that have already run on an issue aren't repeated, even if you changed their settings, so only the steps you've added run. That means a recipient who was already notified isn't notified again. Material applies the response in the background. {% hint style="info" %} Learn more about [configuring default responses](/working-with-issues/respond/configure-default-responses.md). {% endhint %} *** ### OAuth apps #### Enable OAuth App Auto Classification The **Auto-classify OAuth apps** setting is now available for you to enable. When it's enabled, Material automatically applies the OAuth Remediation Agent's recommended classification to new and audited app connections, so you don't have to review and save each suggestion yourself.
The OAuth Apps settings page, showing the Auto-classify OAuth apps toggle.

Enable OAuth app auto-classification in Settings.

To enable it, navigate to **Settings** > **OAuth Apps**, then scroll to **Auto-classify OAuth apps** and toggle it on. The setting stays off until you toggle it on. * When you enable it, Material tells you how many apps still have suggested classifications pending from before the setting was enabled. Click **Review Suggested Classifications** to go straight to those apps in **Explorer** > **Apps**. * To track what still needs review, navigate to **Explorer** > **OAuth Apps** then use the new **Classification State** filter on the OAuth apps list. Filter by **Suggested** or **Applied**. The column is also included in the CSV export.
The Classification State filter for the OAuth apps list, with Suggested and Applied options.

Filter OAuth apps by classification state.

#### Sources and citations in OAuth app investigations OAuth app investigations now show the web searches and sources the OAuth Remediation Agent used to reach its verdict. Each step backed by a search shows how many sources and searches it used, and the full investigation marks each claim with a citation you can follow back to its source. This lets you check the evidence behind an app's verdict before you act on it. {% hint style="info" %} Learn more about [OAuth detections and classification](/workspace-protections/oauth-security/oauth-detections-and-classification.md). {% endhint %} *** ### Detections #### Export your detections to CSV You can now export the Detections list to CSV, the same way you can export issues. To export, from the left navigation click **Detections**, then use the export menu above the list.
The Detections page export menu, with an option to export detections to CSV.

Export the Detections list to CSV.

The export includes each detection's: * ID, name, and description * Entity type and detection type * Categories and tactics * Status and severity * Who created it, when it was created, and when it was last updated Use it to take an inventory of your detections or audit them outside Material. #### Broader built-in email threat coverage Material's built-in email threat detection now catches more: * Fake password reset and file-share lures * Image-based business email compromise * W-9 whaling scams * HR and recipient-domain impersonation * More fake calendar invite lures, including voicemail, audio, and document themes Existing coverage also got tuned to cut down false positives, so you see fewer issues for legitimate mail. {% hint style="info" %} Built-in detection coverage updates roll out continuously, independent of the release cycle. {% endhint %} *** ### Email threats and VIPs #### Smarter suggested VIPs Suggested VIPs are now derived from each person's job title and department in your directory. Material suggests the people an attacker is most likely to impersonate: * Executives * High-authority roles, such as general counsel, controllers, and chiefs of staff * Leaders in finance, legal, HR, payroll, and procurement Shared mailboxes, guest, unlicensed, and suspended accounts, and accounts that are already VIPs aren't suggested. Suggestions you've dismissed stay dismissed. When you open a suggested account, the **Suggested VIP** card tells you why Material suggested it, so you can review suggestions faster. Your VIP list feeds Material's VIP impersonation detections, so better suggestions mean better protection for the people who matter most. Suggestions refresh periodically, so updated suggestions appear after the next refresh. They're most useful when your directory has job titles filled in. {% hint style="info" %} Learn more about [reviewing suggested VIPs](/getting-started/deployment-guides/your-first-30-days/6-enable-email-remediation/add-a-vip.md). {% endhint %} *** ### Identity Protection #### Clearer notices when a message is held or blocked When Identity Protection holds or blocks an identity email, the notice the recipient sees in their inbox is now clearer: * The wording is the same for every held message and every blocked message, and it no longer names a sender or service * A new **Original message** section shows when the message was received (in UTC), who it was sent to, and who actually sent it * Email addresses in the plain-text version are written so that mail clients don't turn them into clickable links This gives recipients the details they need to recognize the message, without giving an attacker's links a place to spread. {% hint style="info" %} Learn more about [enabling Identity Protection](/getting-started/deployment-guides/deploy-account-takeover-resilience-ator/enable-identity-protection.md). {% endhint %} #### Email Identity Protection report improvements The Email Identity Protection report reads more clearly and keeps your place.
The Email Identity Protection report, showing the handling summary and service matrix.

Review the Email Identity Protection report.

* The handling summary opens with a plain description of what Identity Protection does, and always names both outcomes, held and blocked, even when one of them is zero * The service matrix shows about twice as many services before you need to scroll * The **Most successful verifications** and **Frequent verification failures** lists match the styling of the Email Threats report * Clicking an account opens its details over the report, so you don't lose your place * The category filter under the chart becomes a dropdown on narrow screens, and a legend in PDF exports. This also applies to the charts on the Email Threats report. {% hint style="info" %} The Email Identity Protection report is available for customers with [Account Takeover Resilience](broken://spaces/ksjM8NywYRSHu1IlfxdP/pages/ybxYchXncDUTCs2GYaEw) (ATOR) licenses. {% endhint %} *** ### Dedicated instances #### Identify tenants in the Global view If you manage more than one tenant, the Global view now makes it clear which tenant you're looking at: * The **Assignee**, **Recipient**, and **Related Entity** filters, and account pickers, show the tenant name next to each account, so you can tell apart accounts that share an email address across tenants * A detection's page shows a banner when one or more tenants override the default settings you're viewing * The simulation domain picker labels each domain **Google** or **Microsoft** *** ### API and MCP #### Message Search API returns standard rate-limit responses When you reach your Message Search usage limit, `POST /api/v1/messages/search` and MQL message searches now return HTTP `429 Too Many Requests` instead of `400 Bad Request`. The response includes these headers so your client knows when to try again: * `X-RateLimit-Limit` * `X-RateLimit-Remaining` * `X-RateLimit-Reset` * `Retry-After` Successful requests also return the `X-RateLimit-*` headers, so you can track your remaining usage as you go. Searches that are rejected don't count against your limit. {% hint style="warning" %} If your integration checks for a `400` response to detect that it's hit the limit, update it to handle `429`. {% endhint %} {% hint style="info" %} Learn more about [v1 API errors and troubleshooting](https://docs.material.security/reference). {% endhint %} #### MCP server returns standard rate-limit responses When a request to the Material MCP server is rate-limited, it now returns HTTP `429` with a `Retry-After` header and JSON-RPC error code `429`. AI clients and agents connected to Material can now recognize the limit, wait, and retry on their own. {% hint style="info" %} Learn more about the [Material MCP server](https://docs.material.security/reference/material-mcp-server). {% endhint %} *** ## :eyes: Coming Soon ### A new navigation built around how you work We're excited to share a preview of a big change coming to Material. We've redesigned the left navigation so you can find what you need faster and see everything Material does to protect your organization. #### What's changing Right now, the navigation is organized by entity types and detection categories. That's how Material is built, but it's not always how you think about security. The new navigation is organized around the outcomes you care about, like stopping email threats, triaging user reports, and keeping sensitive files from being overshared.
Here's what to expect: * **Sections built around security outcomes.** The navigation now groups pages under **Email Protections** (**Email Threats**, **User Reports**, **Email Bomb Attacks**, **Email Redaction**, **Email Identity Protection**, and **Simulations**) and **Workspace Protections** (**Google Drive Security** and **OAuth Security**). * **Focused issue and detection lists.** Each section has its own issues and detections, so you see what's relevant to that area without having to filter the full list yourself. * **Settings where you need them.** Each type of protection has its own settings, right next to the issues and detections they affect. Settings that apply to your whole organization or to a specific domain stay together in global settings. * **Audit Log** now lives in the top bar, next to the Settings icon. * **Familiar pages in new homes.** The reports and inventories you use today aren't going away. They're moving into the section they belong to. * **Everything else in one place.** **All Issues** and **Explorer** stay at the top of the navigation, and **Detections**, **Sensitive Categories**, and **Trusted Entities** now share their own section. * **A clearer view of what Material can do.** You'll be able to see every capability available to your organization, including ones you haven't turned on yet. #### More to come This is just a sneak peek. We'll share more details soon, including a walkthrough of the new layout, updated documentation, and tips for finding your favorite pages. Stay tuned! *** ## 🐛 Fixes **Issues and remediation** * The **Sensitive Categories** column in the Issues list now shows values for file issues, so you can see at a glance what sensitive content a file holds. * Bulk account remediation now reports accurate results, for example "Remediated 8 of 10 accounts; 2 accounts could not be remediated," so you know which accounts still need attention. Google admin and super admin accounts are skipped when signing users out of their Google sessions, because Google doesn't allow it for those accounts. **Email and accounts** * The **Force Unlock** form now explains that a request unlocks every sensitive message for the account and date range you choose, and the query field is labeled **Query (optional)**. How Force Unlock works hasn't changed. * When an account is reactivated, Material now picks up its new OAuth app grants right away, so your OAuth detections see them without a delay. * Messages under a hold in Microsoft 365 no longer hold up account-level actions. Material skips those messages and records them in the account's audit log. **Phishing simulations** * In the simulation editor, switching the reply-to address to **Custom** no longer shows an "Incorrect request" error. * When a simulation recipient doesn't have Gmail enabled, Material now marks them **Undeliverable** right away instead of leaving them in **Pending**, so your campaign status reflects who can actually receive the simulation. * On dedicated instances, API calls to list simulations no longer require `uDomainIds`. If you leave it out, Material returns simulations from every tenant you can access. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.material.security/whats-new/version-1.64.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.