OAuth FAQ
What's the difference between Essentials and Advanced for OAuth?
Material offers two OAuth tiers:
Essentials gives you real-time OAuth inventory, scope visibility, and account blast radius across connected apps. You can see which apps are connected, what scopes they have, and how many users are affected. Remediation remains manual.
Advanced includes everything in Essentials, plus the OAuth Remediation Agent. This adds investigation, classification suggestions, token revocation, end-user notifications, and recurring 90-day audits.
Which OAuth features require Advanced, and which are included in Essentials?
Real-time OAuth inventory
✔️
✔️
Scope visibility and account blast radius
✔️
✔️
Application was granted OAuth access for the first time detection
✔️
✔️
Manual app classification and response
✔️
✔️
AI-powered investigation (OAuth Remediation Agent)
✔️
End-user notifications (Slack)
✔️
Recurring 90-day OAuth audits
✔️
Does Material automatically classify and revoke OAuth apps?
Not yet. Here's how the current flow works:
When an app is investigated, Material suggests a classification.
Material does not assign that classification automatically. An admin must apply it manually or accept the suggestion.
The configured response runs only after a classification is applied. For example, if you apply Malicious and the default response is token revocation, revocation runs at that point.
Review OAuth Detections and Classification and OAuth Remediation Responses for more detail. We'll share future changes in release announcements and What's New.
I can see "Revoke token for all users" is configured in my settings. Is Material already revoking tokens?
No. Response by classification defines what runs when a classification is applied to an app. Nothing runs until that classification is set on a specific app.
If an app already shows a classification in Explorer > Apps > OAuth, your team classified it manually and the response has already run. For unclassified apps, no response has fired.
Is Material blocking apps from being installed in my environment?
No. The OAuth Remediation Agent is detect-and-respond, not preventative blocking. Users can still install apps. Material detects new OAuth connections in real time, investigates them, and runs the configured response after an admin applies a classification.
Apps authorized before the feature was enabled remain active until they are reviewed and classified.
Why didn't my response fire after the agent investigated an app?
Responses are triggered by classification, not investigation. The agent can investigate an app and suggest a classification, but the response runs only after a classification is applied. Check that:
You've applied a classification to the app, not just viewed the investigation or seen a suggestion.
A response is configured for that classification under OAuth Security > Settings > Response by classification.
The OAuth App Remediation setting is enabled in Settings > Default Account Settings.
If all three are in place and the response still has not fired, contact support.
Is there an API for OAuth app classification data?
No. Material does not currently provide an API for OAuth app classification status. We'll announce availability in release notes and What's New.
Why does an app show as "Unclear" for App Behavior Risk?
Unclear means the agent has no recorded runtime activity for the app yet. It does not mean the app is safe. This is common for newly connected apps or apps that have not been used since authorization.
Treat Unclear as unknown until activity is recorded. Review risk factors and classification for more context.
Can I stop responses from firing for specific users or service accounts?
Yes. By default, accounts and groups inherit the global response settings. You can override this for specific accounts or groups. For example, you can exclude service accounts from automatic remediation or apply stricter settings to high-privilege users.
Last updated
Was this helpful?