We have files or folder restored by Danet which assigns us as the owner, but when the tenancy user shares or accesses a file, it generates a Cloud Apps Alert. It's a false alert and shouldn't assign us as the owner.

We have files or folder restored by Danet which assigns us as the owner, but when the tenancy user shares or accesses a file, it generates a Cloud Apps Alert.

It's a false alert and shouldn't assign us as the owner.

User's image

JamesTran-MSFT 36,531 Reputation points Microsoft Employee

2023-05-30T20:57:00.0233333+00:00
@Angelito Balbin | Danet Technology

Thank you for your post!

I understand that you have files restored which are then assigned to you as the Owner, but when users share or access a file, Defender for Cloud Apps generates the alert shared in your initial post. To gain a better understanding of your issue:

When viewing the Incident Report are you able to confirm that the File wasn't shared externally?

Have you looked at your File Policy - "File shared externally" to ensure the filters are correct to prevent these false alerts?

When Danet restores these folders/files are these all from your internal tenant?

Any additional screenshots, documentation, or details on your issue would be greatly appreciated.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

Share via

We have files or folder restored by Danet which assigns us as the owner, but when the tenancy user shares or accesses a file, it generates a Cloud Apps Alert. It's a false alert and shouldn't assign us as the owner.