Question
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Cloud Apps.
You plan to deploy a Defender for Cloud Apps file policy that will be triggered when the following conditions are met:
- A file is shared externally.
- A file is labeled as internal only.
Which filter should you use for each condition? To answer, drag the appropriate filters to the correct conditions. Each filter may be used once, more than once, or not at all.
NOTE: Each correct selection is worth one point.
Explanation
In a Defender for Cloud Apps file policy, the Access level filter describes how a file is shared (Public, Public with link, External, Internal, Private), so setting it to External catches files shared outside the organization. The Sensitivity label filter matches files by their applied Microsoft Purview label, so it identifies files labeled Internal only. Collaborators filters on specific users or groups that have access, and Matched policy filters on files already matched by other policies, so neither expresses these conditions.
