OAuth Response

Response

The OAuth Remediation Agent shares its investigation and analysis in issues based on the four OAuth Remediation detections. Two responses are available to take action on the issues:

• Revoke token for all users removes the OAuth access grant for every protected user who has connected the app, immediately terminating the app's access to their Google Workspace data. The app cannot reconnect unless a user re-authorizes it.
• Notify revoked users sends a Slack direct message to each affected user when their token is revoked, letting them know the app has been blocked or removed.

Configure your app classifications

Be sure you've reviewed your app list and classified them so that default responses can trigger appropriately.

Default Responses

Default responses trigger whenever an app is classified — whether the agent assigns the classification automatically or you apply it manually. Material pre-configures responses based on its recommendations. You can adjust them at any time:

1. From the left navigation, expand OAuth Security, then click Settings.
2. Scroll to Response by classification:

1. Select a response and save.

To Notify revoked users, you need to set up end-user notifications first.

Manual Response

You can manually update the response for a specific app, if it differs from how you would respond to that classification in general:

1. From the workspace, navigate to Explorer > Apps > OAuth.
2. Click an App to open the App Display view, then add or remove responses on the right:

Revoke a single user's token

To revoke access for one user without affecting everyone else connected to the same app:

1. Navigate to Explorer > Apps > OAuth.
2. Select an app, then click the Accounts tab.
3. Find the user's row, then from the row actions click Revoke app token.

Confirming the action revokes that user's Google OAuth token, marks their row inactive, and records a revoke event on the app timeline. When end-user notifications are enabled, the timeline also records a Notified user event once the affected user has been told their access was revoked. Admin-initiated revocations are distinguishable from automated ones in the timeline, so you can tell them apart in an audit.

Revoke tokens for multiple accounts

To revoke access for several accounts at once:

1. Navigate to Explorer > Apps > OAuth.
2. Select an app, then click the Accounts tab.
3. Select the accounts you want, then click Revoke app token from the batch toolbar (or ⌘K).

---

Override remediation for an account or group

By default, accounts and groups inherit the global response settings. You can override this for specific accounts or groups, for example, to exclude service accounts from automatic remediation or apply stricter settings to high-privilege users.

1. From the workspace, navigate to Explorer > Accounts (or Groups).
2. Select one or more rows.
3. From the bottom toolbar, click Edit Settings.
4. Under Remediations, scroll to OAuth App Remediation, then select Override OAuth App Remediation and toggle it On.

1. Save.

---

Set up end-user notifications

The agent can notify end users when an app they've tried to use is blocked or revoked. Notifications must be configured to use this response.

Slack

Send Slack direct messages to users when an app is classified as Unnecessary, Overprivileged, Suspicious or Malicious.

Connect Slack

Slack notifications require a Slack connection. If your workspace isn't connected, the OAuth Security > Settings page prompts you to connect it first:

Enable

1. From OAuth Security > Settings, scroll to End-user notifications.
2. Under Slack, toggle the setting On:

   

Preview

Notifications are pre-configured by Material. Malicious classification notifications are slightly different from the other classifications. You can preview notifications in the settings.

Preview the notification in settings

Email Notifications will be added in the future, stay tuned! We'll share more news in our release announcements and What's New.