Question

Your organization uses Microsoft Defender for Cloud Apps connected to SharePoint Online and OneDrive. The security team wants an automated response whenever a file containing credit card numbers is shared with external users: the file should be placed in administrative quarantine and the file owner notified. You create a file policy that detects the sensitive content and the external sharing condition. Which governance action in the file policy meets the requirement to remove external access while preserving the file for review?

Accepted Answer

Apply the 'Put in admin quarantine' governance action, which moves the file to a quarantine location and replaces it with a tombstone

Answer

Apply the 'Make private' governance action to remove external collaborators from the file

Answer

Apply a Microsoft Purview sensitivity label with encryption via the file policy

Answer

Apply the 'Trash' governance action to permanently delete the file from the user's OneDrive