How do you alert on external sharing of sensitive OneDrive files?
Short answer
D From the Microsoft Defender portal, create a Defender for Cloud Apps file policy that alerts when sensitive OneDrive files are shared with external users.
Question
What should you do?
Key Takeaways
The question tests the difference between file policies and activity policies in Defender for Cloud Apps; the trap is assuming every sharing action must be handled by an activity policy.
Microsoft Defender for Cloud Apps file policies can detect sensitive OneDrive files shared with external users and generate an alert. This page establishes why the file policy in the Defender portal is the correct SC-401 answer rather than an activity policy or eDiscovery search.
Common mistake: The common wrong answer is an activity policy, because sharing looks like a user event; however, the requirement centers on sensitive files shared externally, which a file policy evaluates.
Expert Analysis
Why the Answer Is Correct
A Defender for Cloud Apps file policy is the policy type designed to scan connected storage such as OneDrive and alert on file-level conditions, including files shared with external domains and files that match sensitivity or content-inspection criteria. In the Microsoft Defender portal you navigate to Cloud Apps > Policy management > Create policy > File policy, then scope the policy to OneDrive and add a sharing filter for external users or domains. This matches the requirement to be alerted about sensitive documents that are already shared outside the company. Microsoft's data-protection-policies documentation explicitly lists "Sharing with external domains" as a file-policy example, which is why option D is the decisive match.
Why the Other Options Are Wrong
An activity policy (A) can alert on user activities such as sharing events, but it is not the documented policy type for evaluating a file's sharing state and sensitivity together; the requirement is about the sensitive file being shared externally, not just the act of sharing. Advanced eDiscovery (B) is an investigation and legal-hold tool, not a real-time alerting mechanism for OneDrive external sharing. Exchange admin center DLP (C) is scoped to Exchange mail flow and related Exchange workloads, so it does not create the OneDrive external-sharing alert described here.
Community Comment Notes
Eltooth described the practical path through Cloud Apps > Policy Management > Create Policy > File Policy, which aligns with Microsoft's documented file-policy workflow. 6b5b744 argued for an activity policy because sharing is event-driven, but B73 pointed to Microsoft's data-protection-policies page, where external-domain sharing is listed as a file-policy example. subhuman's comment that "This is an ACTIVITY POLICY not a FILE POLICY" captures the common trap, yet the file policy remains the one that evaluates the shared sensitive file. Jideakin's note about not finding the option highlights the importance of entering through the Defender portal's Cloud Apps area rather than a Purview DLP screen.
Official Reference
https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a scenario mentions files in OneDrive or SharePoint being shared with external domains, start with a Defender for Cloud Apps file policy. Reserve activity policies for user-action monitoring where file content or sharing state is not the trigger. Use the Defender portal's Cloud Apps area, not Exchange admin center, for OneDrive coverage.
Frequently Asked Questions
Why not use an activity policy for OneDrive external sharing?
Does Exchange admin center DLP alert on OneDrive sharing?
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
Eltooth 👍 7 Answered DD is correct answer. From Defender portal, click Cloud Apps, Policy Management, Create Policy, File Policy
-
6b5b744 👍 2 Answered AActivity policies monitor file sharing events when they are shared triggering real time alerts. A file policy evaluates files at rest and are not event-driven on sharing actions.
-
Gtc_ 👍 2 Answered DFile policy.
-
B73 👍 1https://learn.microsoft.com/en-us/defender-cloud-apps/data-protection-policies The following are examples of file policies that can be created: Sharing with external domains - Receive an alert about any file shared with accounts owned by specific external domains. For example, files shared with a competitor's domain. Select the external domain with which you want to limit sharing.
-
subhuman 👍 1 Answered AThis is an ACTIVITY POLICY not a FILE POLICY . You want to be alerted when users share sensitive documents from One drive to people outside the company . This is an activity event. So you can use a policy that monitors user actions and triggers events.
Show 2 more comments
-
kollyp2000 👍 1 Answered DD. From the Microsoft Defender portal, create a file policy.
-
Jideakin 👍 1I tried this and there was no way to create it. Pls try it.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.