You need to be alerted when users share sensitive documents from Microsoft OneDrive to any users outside your company. What should you do?

Question

Options

• AFrom the Microsoft Purview portal, create an insider risk policy.
• BFrom the Microsoft Defender portal, create a file policy.
• CFrom the Microsoft Defender portal, create an activity policy.
• DFrom the Microsoft Purview portal, start a data investigation.

• A
  10% (3)
• B
  17% (5)
• C
  69% (20)
• D
  3% (1)

Explanation

To receive real-time alerts when users share OneDrive documents with external users, you create an Activity policy in the Microsoft Defender portal (Microsoft Defender for Cloud Apps). Activity policies monitor and alert on specific user actions-such as file sharing with external domains-as they occur. A File policy (option B) is used for ongoing data governance scans of files at rest, not for event-triggered sharing alerts. An Insider risk policy (option A) in Purview focuses on behavioral risk patterns over time, not immediate external-sharing alerts. Starting a data investigation (option D) is a reactive forensic action, not a proactive alerting mechanism. Activity policies are the correct tool for real-time external-sharing event alerts.

No community discussion yet for this question.