How do you alert on external sharing of sensitive OneDrive files?
You need to be alerted when users share sensitive documents from Microsoft OneDrive to any users outside your company. What should you do?
Community Insight
The question tests the difference between file policies and activity policies in Defender for Cloud Apps; the trap is assuming every sharing action must be handled by an activity policy.
Microsoft Defender for Cloud Apps file policies can detect sensitive OneDrive files shared with external users and generate an alert. This page establishes why the file policy in the Defender portal is the correct SC-401 answer rather than an activity policy or eDiscovery search.
The common wrong answer is an activity policy, because sharing looks like a user event; however, the requirement centers on sensitive files shared externally, which a file policy evaluates.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Defender for Cloud Apps file policy is the policy type designed to scan connected storage such as OneDrive and alert on file-level conditions, including files shared with external domains and files that match sensitivity or content-inspection criteria. In the Microsoft Defender portal you navigate to Cloud Apps > Policy management > Create policy > File policy, then scope the policy to OneDrive and add a sharing filter for external users or domains. This matches the requirement to be alerted about sensitive documents that are already shared outside the company. Microsoft's data-protection-policies documentation explicitly lists "Sharing with external domains" as a file-policy example, which is why option D is the decisive match.Why the Other Options Are Wrong
An activity policy (A) can alert on user activities such as sharing events, but it is not the documented policy type for evaluating a file's sharing state and sensitivity together; the requirement is about the sensitive file being shared externally, not just the act of sharing. Advanced eDiscovery (B) is an investigation and legal-hold tool, not a real-time alerting mechanism for OneDrive external sharing. Exchange admin center DLP (C) is scoped to Exchange mail flow and related Exchange workloads, so it does not create the OneDrive external-sharing alert described here.Community Comment Notes
Eltooth described the practical path through Cloud Apps > Policy Management > Create Policy > File Policy, which aligns with Microsoft's documented file-policy workflow. 6b5b744 argued for an activity policy because sharing is event-driven, but B73 pointed to Microsoft's data-protection-policies page, where external-domain sharing is listed as a file-policy example. subhuman's comment that "This is an ACTIVITY POLICY not a FILE POLICY" captures the common trap, yet the file policy remains the one that evaluates the shared sensitive file. Jideakin's note about not finding the option highlights the importance of entering through the Defender portal's Cloud Apps area rather than a Purview DLP screen.Official Reference
Exam Strategy
When a scenario mentions files in OneDrive or SharePoint being shared with external domains, start with a Defender for Cloud Apps file policy. Reserve activity policies for user-action monitoring where file content or sharing state is not the trigger. Use the Defender portal's Cloud Apps area, not Exchange admin center, for OneDrive coverage.
Frequently Asked Questions
Why not use an activity policy for OneDrive external sharing?
Activity policies watch user actions, but the documented external-sharing scenario for sensitive files is handled by a Defender for Cloud Apps file policy.
Does Exchange admin center DLP alert on OneDrive sharing?
No, that DLP policy is Exchange-scoped; OneDrive external-sharing alerts require a Defender for Cloud Apps file policy.