Forum Discussion

LewkirSG's avatar
LewkirSG
Copper Contributor
Feb 14, 2025

What happened to being able to see who a file was shared with in Defender XDR?

We get a lot of alerts for "File shared with personal email addresses involving one user" and previously we would be able to select the file that was being shared which would take us to another page ...
luchete's avatar
luchete
Iron Contributor
Feb 27, 2025

Hi LewkirSG,

There have been some changes to the functionality in Defender XDR. The ability to see who a file was shared with directly from the alert was removed in a recent update.

Unfortunately, as you’ve noticed, this means you now need to go through additional steps like accessing SharePoint or OneDrive to check sharing details.

Currently, there’s no direct replacement in the UI for this functionality. The reason behind this change hasn't been clearly explained, or at least I couldn't find it, but it might be related to updates in how the alerts are structured or how the integration works.

Hope that helps. 

Regards!

LewkirSG's avatar
LewkirSG
Copper Contributor
Feb 28, 2025

That's annoying, it's gone from being one of the most easily investigated alerts to one of the least. To the point that I'm considering turning it off completely

  • nengelhardt-isg's avatar
    nengelhardt-isg
    Copper Contributor
    Feb 28, 2025

    I'm running into the same thing - what is the easiest way to investigate this now? I'm having trouble finding who it's shared with at all. My current thought is to give myself permission to the sharepoint site, and check who it's shared with, but that comes with a bunch of its own issues.

Resources