Introduction
In highly regulated industries like finance, healthcare, and legal services, it is often necessary to prevent specific groups of employees from communicating with each other to avoid conflicts of interest or data leaks. Microsoft Teams provides a feature called Information Barriers (IB) that allows administrators to strictly define communication boundaries. This guide explains how to design and deploy Information Barriers to prevent defined groups from chatting, calling, or sharing files.
Prerequisites
Information Barriers require specific licensing, typically Microsoft 365 E5, Office 365 E5, or the advanced compliance add-ons. You also need the Microsoft Teams Administrator and Compliance Administrator roles, and you must use the Exchange Online and Security & Compliance PowerShell modules.
Step 1: Segment Your Users
Before configuring barriers, you must segment your users into identifiable groups based on an Azure Active Directory attribute (e.g., Department). Connect to the Security & Compliance PowerShell module:
Connect-IPPSSession -UserPrincipalName [email protected]
Create a segment for your Investment Bankers based on their AD Department attribute:
New-OrganizationSegment -Name "Investment Bankers" -UserGroupFilter "Department -eq 'InvestmentBanking'"
Create a second segment for your Advisory team:
New-OrganizationSegment -Name "Advisory Team" -UserGroupFilter "Department -eq 'Advisory'"
Step 2: Define the Information Barrier Policies
Now that you have defined the segments, you must create policies that dictate how they interact. In this scenario, we want to block the Investment Bankers from communicating with the Advisory Team.
Create a policy that blocks the Bankers from the Advisory segment:
New-InformationBarrierPolicy -Name "Block Bankers to Advisory" -AssignedSegment "Investment Bankers" -SegmentsBlocked "Advisory Team" -State Inactive
You must also create the reverse policy to ensure the block is bidirectional:
New-InformationBarrierPolicy -Name "Block Advisory to Bankers" -AssignedSegment "Advisory Team" -SegmentsBlocked "Investment Bankers" -State Inactive
Notice that the policies are created in an Inactive state. This allows you to review them before they affect users.
Step 3: Activate the Policies
Once you have verified the policy logic, activate them:
Set-InformationBarrierPolicy -Identity "Block Bankers to Advisory" -State Active
Set-InformationBarrierPolicy -Identity "Block Advisory to Bankers" -State Active
Step 4: Apply the Information Barriers
Activating a policy does not immediately enforce it. You must run the application command, which instructs Microsoft 365 to scan all users, evaluate the segment rules, and enforce the communication blocks across Teams, SharePoint, and OneDrive.
Start-InformationBarrierPoliciesApplication
This process can take several hours depending on the size of your tenant. You can check the status using:
Get-InformationBarrierPoliciesApplicationStatus
The User Experience
Once applied, the Information Barriers act silently but strictly. If a user in the Investment Banking segment attempts to search for an Advisory team member in Teams, the user will not appear in the directory. If they attempt to add them to a team or group chat, the system will instantly reject the action with a generic permission error. Existing 1:1 chats between newly blocked users will become read-only, preventing any further communication.