alert on External Sharing event

[nExoR nExoiS]

I'm trying to create an alert that will inform Security team on External Sharing event from Teams. I found that there are some controls over SharePoint and then some Activity Types related to sharing... but I don't know what each of this action means and how to narrow down to only 'external sharing'?

- is there detailed documentation describing each Action Type for each App? 

- how distinguish between external/internal? 

thx!

[#2]

Teams is using SharePoint for file storage, so you need the SPO controls/actions. The list of events generated can be found for example here: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compl...

In MCAS, you can use the "Access level" controls as detailed here: https://docs.microsoft.com/en-us/cloud-app-security/data-protection-policies