Forum Discussion
alert on External Sharing event
I'm trying to create an alert that will inform Security team on External Sharing event from Teams. I found that there are some controls over SharePoint and then some Activity Types related to sharing... but I don't know what each of this action means and how to narrow down to only 'external sharing'?
- is there detailed documentation describing each Action Type for each App?
- how distinguish between external/internal?
thx!
1 Reply
Teams is using SharePoint for file storage, so you need the SPO controls/actions. The list of events generated can be found for example here: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compliance#sharing-and-access-request-activities
In MCAS, you can use the "Access level" controls as detailed here: https://docs.microsoft.com/en-us/cloud-app-security/data-protection-policies
