Question

Your organization uses Defender for Cloud Apps with the Microsoft 365 app connector fully connected. The compliance team reports that files containing credit card numbers are being shared externally through SharePoint Online. They want Defender for Cloud Apps to automatically detect these files at rest and place any matching file into administrative quarantine. Which type of policy should you create?

Accepted Answer

A file policy that inspects content using a built-in DLP inspection method and applies the 'Put in admin quarantine' governance action

Answer

An activity policy that triggers on 'Share file externally' events and suspends the sharing user

Answer

A session policy that blocks download of files matching a sensitive information type

Answer

An anomaly detection policy scoped to SharePoint Online