Information Barriers in Purview: segments, policies and fixing blocked users in Teams

Information Barriers (IB) in Microsoft Purview stop selected groups of people from finding, chatting, calling, meeting and sharing with each other, typically between departments such as research and sales in regulated firms. When IB misbehaves, it either blocks people who should collaborate or lets through people who shouldn't. In this post I'll show what users see, why it happens, and the checks that pin it down.

Symptoms#

• A user can't find a colleague in Teams search, the people picker or the People tab, and starting a new 1:1 or group chat with them doesn't work.
• An existing 1:1 chat became read-only, or someone was removed from a group chat or a team after a policy or job change.
• Call and screen-share options are missing, and hovering over a person shows an error instead of their people card. Org charts show an error in place of a blocked user.
• A user isn't allowed into a Teams meeting.
• SharePoint or OneDrive shows an access-denied page reading Due to organizational policies, you can't access this resource. Variants that end in "from this network location" or "from this untrusted device" come from other access policies; see SharePoint access denied errors.
• The opposite: people in blocked segments can still chat or open each other's team files.

Why it happens#

IB places users into segments based on directory attributes such as Department or group membership. Then a block or allow policy is assigned to each segment and applied. Teams evaluates IB when someone adds members, starts a chat, invites to a meeting, shares a screen or places a call, and it rechecks existing chats when policies change. Typical causes:

• Wrong directory data: a missing or changed Department value puts a user in the wrong segment, or in none.
• Policies not live: new or edited policies do nothing until they're Active and applied, and application runs user by user at roughly 5,000 accounts per hour after a start delay of about 30 minutes.
• One-way rules: a block policy works in one direction only, so blocking both ways needs two policies. Each segment can have only one policy.
• Organization mode: tenants are in Legacy, SingleSegment or MultiSegment mode. Legacy mode is built on Exchange address book policies, allows only one segment per user (up to 250 segments) and, with allow policies, hides people who aren't in any segment. The newer modes support up to 5,000 segments and up to 10 segments per user in MultiSegment mode.
• Resource modes: Microsoft 365 groups, teams, sites and OneDrive have their own IB mode: Open (no IB), Owner Moderated, Implicit (default for new teams), Explicit (segments on the site) and Mixed (OneDrive only). Teams created before IB was enabled stay Open, so they don't enforce barriers until you change them.
• SharePoint and OneDrive not enabled: IB doesn't protect a team's SharePoint site and files by default.

How to fix it#

1. Check the organization mode and the two users#

You need the Compliance Administrator or IB Compliance Management role (see Purview roles). In Security & Compliance PowerShell:

Connect-IPPSSession
Get-PolicyConfig | Format-List *InformationBarrier*
Get-ExoInformationBarrierRelationship -RecipientId1 meganb -RecipientId2 alexw

The relationship output shows both users' attribute values and the IB policies that apply to them. That answers "is IB involved at all?"

2. Fix segments and directory data#

Get-OrganizationSegment | Format-Table Name, UserGroupFilter

Compare each filter, such as Department -eq 'Sales', with the user's actual attribute in Microsoft Entra ID (or on-premises Active Directory if synced) and correct the attribute rather than the segment. Segment names can't be changed later, so keep filters simple (-eq and -ne). As resources, IB covers only Microsoft 365 groups; distribution lists and security groups are treated as non-IB groups.

3. Fix the policies#

Get-InformationBarrierPolicy |
    Format-Table Name, AssignedSegment, SegmentsAllowed, SegmentsBlocked, State

• Every intended block has a policy in each direction, and no segment has two policies.
• Allow policies follow Microsoft's syntax, which lists the assigned segment itself, for example -AssignedSegment "Manufacturing" -SegmentsAllowed "HR","Manufacturing".
• To switch a policy between Allowed and Blocked, delete it and create a new one; the type can't be edited.
• Policies meant to be live show Active. Activate one with Set-InformationBarrierPolicy -Identity <GUID> -State Active.

4. Re-apply and watch the status#

Start-InformationBarrierPoliciesApplication
Get-InformationBarrierPoliciesApplicationStatus
Get-InformationBarrierPoliciesApplicationStatus -All

Or select Apply all policies on the Policy application page of the Information Barriers solution in the Microsoft Purview portal. The status shows whether the run is in progress, completed or failed. Audit logging must be on to look up application status.

5. Fix Teams modes#

If blocked people still collaborate in older teams, move those teams from Open to Implicit in Exchange Online PowerShell. Use Owner Moderated only for teams that deliberately bring incompatible segments together under an owner's control. When you change a Teams-connected group's mode, update its SharePoint site's mode too.

Set-UnifiedGroup -Identity "Research Team" -InformationBarrierMode Implicit

6. Enable and check SharePoint and OneDrive#

Turn on IB for SharePoint and OneDrive with the SharePoint Online Management Shell, following Microsoft's guide to using IB with SharePoint. Then check the site's IB mode and associated segments: with Explicit, access follows the segments associated with the site, which explains the access-denied page for users outside them.

7. Meetings#

Every meeting in an IB-enabled tenant checks IB at entry by testing whether the user can be added to the meeting chat roster. Once that roster reaches 1,000 users, nobody else can join; remove inactive members from the meeting chat or use a town hall for large audiences. People who aren't team members can't join channel meetings.

Verify the fix#

• Get-InformationBarrierPoliciesApplicationStatus reports the latest run as completed.
• Get-ExoInformationBarrierRelationship for a test pair shows the expected policies.
• With two pilot accounts in blocked segments: neither appears in the other's people picker (unless you turned the search restriction off) and a new chat can't start. With two compatible accounts, chat, calls and file access work.
• A user outside an Explicit site's segments gets the access-denied page; a member opens it normally.

Key takeaways#

• Clean HR attributes keep segments right; a department change moves people between segments and triggers rechecks in Teams.
• Prefer block policies, as Microsoft recommends for a consistent user experience. Create policies Inactive, then activate and apply them in a quiet window.
• After enabling IB, move existing teams out of Open mode and enable IB for SharePoint and OneDrive.
• Users of federated external organizations aren't restricted by your IB policies, though your own users stay restricted in external chats and meetings. See external vs guest access.
• To watch conversations between groups instead of blocking them, consider the conflict of interest template in Communication Compliance.

References#

• Get started with Information Barriers
• Information Barriers in Microsoft Teams