After you connect an app to Defender for Cloud Apps, integrate with Microsoft Purview Information Protection. Then, in the Files page, filter for files labeled Confidential and exclude your domain in the Collaborators filter. If you see that there are confidential files shared outside your organization, you can create a file policy to detect them.
Reference:
https://learn.microsoft.com/en-us/defender-cloud-apps/file-filters
https://learn.microsoft.com/en-us/microsoft-365/compliance/how-dlp-works-between-admin- centers