In Microsoft Defender for Cloud Apps, File Policies use specific metadata filters to scan and identify documents across connected cloud environments.

1. Access level: This filter is specifically designed to categorize files based on their sharing permissions. The available options typically include Internal, External, Public (Internet), and Private. Therefore, to detect when a file is shared externally, the "Access level" filter must be used.
2. Sensitivity label: This filter integrates with Microsoft Purview Information Protection. It allows administrators to trigger policies based on specific labels (e.g., "Internal", "Confidential") applied to the file metadata. To identify files labeled "Internal only," this filter is the direct and specific requirement.

Microsoft Purview Documentation: "Create file policies," specifically the section on "File filters." This section defines the Access level filter as the method to identify files shared with external domains.

Microsoft Defender for Cloud Apps Documentation: "Protecting your cloud environment with file policies." It outlines how the Sensitivity label filter allows policies to act on files tagged by Information Protection services.

Microsoft Learn (SC-400/MS-500 Courseware): Module on "Information Protection and Governance," which details the integration between Defender for Cloud Apps and sensitivity labels for automated governance.

Microsoft Documentation: "Reference for file filters in Microsoft Defender for Cloud Apps," detailing the logic for filtering by external access and classification labels.