How to Notify HR Manager When SharePoint Files Are Shared?

MS-102 By islever Editorial Last updated Sep 28, 2026

Implement and manage Microsoft Defender for Cloud Apps

Short answer

B Create an alert policy from the Microsoft Defender portal to notify the HR manager when SharePoint files are shared.

Question

You need to notify the manager of the human resources department when a user in the department shares a file or folder from the department's Microsoft SharePoint site. What should you do?

From the SharePoint site, create an alert.
From the Microsoft Defender portal, create an alert policy. Correct Answer
From the SharePoint admin center, modify the sharing settings
From the Microsoft 365 admin center, configure SharePoint.org settings.

Key Takeaways

The question tests whether you know that SharePoint and OneDrive sharing notifications are built as a Defender for Cloud Apps activity policy, and the common trap is choosing a native SharePoint site alert because it sounds simpler.

Microsoft Defender for Cloud Apps alert policies can notify a manager when HR department users share SharePoint files or folders. This page establishes that the correct MS-102 answer is to create an alert policy from the Microsoft Defender portal (B), not to use a SharePoint site alert or sharing setting.

Common mistake: The most common wrong answer is A, creating an alert from the SharePoint site, because native SharePoint alerts only notify the person who configured them about site-level changes and cannot target an HR manager for department-wide sharing events.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Cloud Apps (MDA) includes activity policies that can detect when a user shares a SharePoint file or folder, including sharing with people outside the organization. In the Microsoft Defender portal, you can create an alert policy that filters on the HR department's users and configures a manager notification by email. This matches option B because it is the only choice that provides a cross-user alerting mechanism tied to SharePoint sharing events. The community consensus also points to B; as Matt19 simply put it, "It is B - via Defender". Murad01 also noted the question is repeated and "Given answer is correct".

Why the Other Options Are Wrong

Option A sounds tempting because SharePoint has native alerts, but those alerts are created at the site or list level and typically notify the person who created the alert about changes to list items or files. They are not designed to notify a manager when any user in a whole department shares a file or folder. Option C is wrong because modifying sharing settings in the SharePoint admin center changes what sharing is permitted, not who gets notified when sharing happens. Option D is also wrong because SharePoint.org settings in the Microsoft 365 admin center control tenant-level configuration, not event-based notifications. Ody captured the trap well: "Can do it in Sharepoint, but Defender is probably the best answer on this exam."

Community Comment Notes

The comments show strong agreement that the Defender portal is the right place for this MS-102 objective. Murad01 confirms the question is repeated and that the given answer is correct, while Matt19 states "It is B - via Defender". Ody notes that SharePoint can technically perform some of this, but emphasizes that Defender is probably the best answer on this exam. This aligns with the exam's preference for centralized Microsoft Defender XDR alerting over site-specific SharePoint alerts.

Official Reference

https://learn.microsoft.com/en-us/defender-cloud-apps/user-activity-policies

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for a manager notification about SharePoint or OneDrive sharing events, think of Defender for Cloud Apps activity policies, not SharePoint-native alerts. On MS-102, the Microsoft Defender portal is the centralized place for cross-workload alert policies.

Frequently Asked Questions

Why can't I create the alert from the SharePoint site instead?

SharePoint site alerts are scoped to a single site and usually notify the alert creator about item changes, so they cannot notify an HR manager whenever any department user shares a file or folder.

Which Defender portal policy type handles SharePoint sharing notifications?

Use a Microsoft Defender for Cloud Apps activity policy, which can detect SharePoint and OneDrive sharing events and send an email alert to the manager.

More MS-102 FAQ →

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

Murad01 👍 5

Repeated question. Given answer is correct
Ody 👍 1

Can do it in Sharepoint, but Defender is probably the best answer on this exam.
Matt19 👍 4 Answered B

It is B - via Defender

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All MS-102 Questions

Access 111 questions with complete answers and detailed explanations.

View Full MS-102 Practice Test →

← Back to MS-102 Study Guide