Microsoft Secure Tech Accelerator
Apr 13 2023, 07:00 AM - 12:00 PM (PDT)
Microsoft Tech Community

alert on External Sharing event

Occasional Contributor

I'm trying to create an alert that will inform Security team on External Sharing event from Teams. I found that there are some controls over SharePoint and then some Activity Types related to sharing... but I don't know what each of this action means and how to narrow down to only 'external sharing'?

- is there detailed documentation describing each Action Type for each App? 

- how distinguish between external/internal? 



1 Reply

Teams is using SharePoint for file storage, so you need the SPO controls/actions. The list of events generated can be found for example here:


In MCAS, you can use the "Access level" controls as detailed here: