Forum Discussion
What happened to being able to see who a file was shared with in Defender XDR?
We get a lot of alerts for "File shared with personal email addresses involving one user" and previously we would be able to select the file that was being shared which would take us to another page where we could see who it was shared with. Now, however, the ellipsis next to the file name is gone and there doesn't seem to be any other way to see who the file was shared with.
This is a massive loss of functionality because even in Cloud App Security or using Kusto this data is missing so the only way to get it is to log into the SharePoint admin centre, find the user's OneDrive, give yourself access, find the file and see who it's shared with. This is many more steps and very inconvenient.
The ellipsis used to be here:
Is there another way for an admin to see who a file is shared with that we are missing?
Why is it no longer bundled in this alert that is specifically meant to show you a problem with a file being shared?
Thanks,
Hi LewkirSG,
There have been some changes to the functionality in Defender XDR. The ability to see who a file was shared with directly from the alert was removed in a recent update.
Unfortunately, as you’ve noticed, this means you now need to go through additional steps like accessing SharePoint or OneDrive to check sharing details.
Currently, there’s no direct replacement in the UI for this functionality. The reason behind this change hasn't been clearly explained, or at least I couldn't find it, but it might be related to updates in how the alerts are structured or how the integration works.
Hope that helps.
Regards!
That's annoying, it's gone from being one of the most easily investigated alerts to one of the least. To the point that I'm considering turning it off completely
I'm running into the same thing - what is the easiest way to investigate this now? I'm having trouble finding who it's shared with at all. My current thought is to give myself permission to the sharepoint site, and check who it's shared with, but that comes with a bunch of its own issues.
