DLP Policy Alert - See External Recipients for SharePoint File

Mitch Silberstein 150 Reputation points
2026-10-29T15:53:05.82+00:00

I have alerts for when users share documents within OneDrive and SharePoint to external users. When I go to review the alerts though I can't see who the external recipients are. Is this something I can view within the DLP Alerts or Activity Explorer?

Microsoft 365 and Office | SharePoint | For business | Other
0 comments
Answer accepted by question author
Kai-Ex 2,565 Reputation points Microsoft External Staff Moderator
2026-11-02T04:02:29.1466667+00:00

Dear Mitch Silberstein,

I understand your situation. According to my research, External recipient identities are not exposed as recipient fields in SharePoint Online or OneDrive for Business DLP alerts.

While DLP alert details can display email recipient information for Exchange-based events, SharePoint and OneDrive DLP alerts typically contain information such as: File name and path, Site URL, Site owner, File owner, File size, Timestamps, and Policy match details. For reference: View alerts

However, the external recipient's email address is generally not included in the alert details. To identify who the file was shared with, I recommend you try following the AI answer's suggestion and reviewing the corresponding events in Microsoft Purview Audit.

Audit records for sharing activities such as: Sharing invitation created, File shared, Anonymous link created, and Secure link created. These often contain the recipient information that is not surfaced in the DLP alert itself. For reference: Use sharing auditing in the audit log

Moreover, to better understand the scenario and determine where the recipient information may be available, could you please provide some additional details?‌

  • Are you viewing the alert from Microsoft Purview > Data loss prevention > Alerts, or from another location?
  • Is the content stored in SharePoint Online or OneDrive for Business?
  • Was the file shared using a Specific people, Organization, or Anyone link?
  • Do you have access to Microsoft Purview Audit (Standard or Premium) in your tenant?
  • When you open the DLP alert details, what information is displayed under the activity or event details section?

Note: As this is a public forum community, please understand that I do not have access to your tenant or its audit logs, so I cannot verify the sharing details directly.

Thank you for your patience and understanding. If you have any questions or are stuck on any steps, please feel free to reach out. I'm looking forward to your update.

Was this answer helpful?

2 people found this answer helpful.
Answer accepted by question author

AI answer

2026-10-29T15:53:56.0266667+00:00

External recipient identities are not exposed as recipient fields in SharePoint or OneDrive DLP alerts; use Microsoft Purview Audit and inspect the corresponding sharing event instead.

DLP alert details provide email recipients only for Exchange events. For SharePoint and OneDrive events, the documented fields include the file path, site URL, site owner, file owner, size, and timestamps—but not the external recipient.^1^

Find the external recipient

  1. In the Microsoft Purview portal, open Solutions → Audit.
  2. On the Search page, set a date and time range covering the DLP event.
  3. Under Activities – friendly names, select Sharing and access request activities.
  4. Narrow the search using information from the DLP alert, such as:
    • User who performed the action
    • File or site path
    • Time of activity
  5. Select Search.
  6. Open the matching sharing record, or select Export results → Download all results for easier analysis.
  7. Inspect these SharePoint sharing-schema properties:
    • TargetUserOrGroupName — the UPN or name of the user/group with whom the resource was shared.
    • TargetUserOrGroupType — identifies the target as a Guest, Member, SharePoint group, security group, or partner.

Microsoft documents this Audit workflow specifically for identifying resources shared with external users. Exported results can also be filtered where TargetUserOrGroupType equals Guest.^2^

Activity Explorer limitation

Activity Explorer can show SharePoint and OneDrive DLP policy-match events, affected files, users, and rule details, but its enhanced display of matched recipient values is documented for Exchange Online DLP events, not SharePoint or OneDrive events.^3^ Therefore, Activity Explorer is useful for correlating the policy match, while Audit is the supported place to identify the sharing target.

For recent events, allow time for the audit record to arrive. SharePoint and OneDrive records are typically available after 60–90 minutes, although Microsoft does not guarantee a specific delivery time.^4^

References

  1. Get started with the data loss prevention alerts
  2. Use sharing auditing in the audit log
  3. Get started with activity explorer
  4. Search the audit log
AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

2 people found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.