To configure Microsoft Defender for Cloud Apps to generate alerts and trigger remediation actions for the external sharing of confidential files, perform the following two actions in the Microsoft 365 Defender portal:
1. From Cloud apps, select Files, and then select New policy from search.
This action allows you to create a file policy that detects when confidential files are shared externally. By setting specific filters and conditions, you can configure the policy to generate alerts and apply remediation actions, such as removing external sharing permissions or applying sensitivity labels, when such sharing is detected.
2. From Settings, select Cloud App, select Microsoft Information Protection, and then select Automatically scan new files for Microsoft Information Protection sensitivity labels and content inspection warnings.
Enabling this option ensures that Defender for Cloud Apps automatically scans new files for sensitivity labels and content inspection warnings. This scanning is crucial for identifying confidential files and applying appropriate policies to protect them from unauthorized external sharing.
By implementing these two actions, Defender for Cloud Apps will be configured to detect and respond to the external sharing of confidential files effectively.