# Apply barriers across Teams, SharePoint and OneDrive - URL: https://m365playbooks.com/playbooks/apply-barriers-across-teams-sharepoint-and-onedrive/ - Topic: Information barriers (Program) - Product: Purview, Teams, SharePoint, OneDrive - Stage: Deploy - Last reviewed: October 16, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Turn the signed design into barriers that hold everywhere people work, one barrier at a time. Applying policies is only part of it: existing teams stay open until their mode changes, SharePoint and OneDrive need barriers turned on separately, and sensitive sites need their segments. Doing it barrier by barrier keeps each change small enough to check and explain. ## 2. Overview Segments and policies created inactive, then activated barrier by barrier, with teams moved to Implicit and SharePoint and OneDrive barriers turned on. - Effort: About 10 to 20 person-days - Duration: 4 to 8 weeks - Complexity: High - Who's in the room: Purview admin, Teams admin, SharePoint admin, compliance lead, service desk lead, owners of affected teams and sites - Beyond E5: Nothing beyond Microsoft 365 E5 - Risk of not doing it: Applied all at once, a mistake in one segment removes people from teams across the organization, and existing teams left open let the barrier be bypassed. ## 3. Key activities ### Prerequisites 1. **Start from a signed go/no-go** Deploy begins where Prepare ends: clean data, scoped directory search on, a tested matrix, membership exports, a rollback plan and briefed owners. If any is missing, finish it first. Who: Compliance lead. Produces: A signed go/no-go. 2. **Create segments and policies, inactive** Create the segments from the matrix, then the policies, and leave every policy inactive. Segment names can't be changed later, so use the names from the design. Defining or editing inactive policies doesn't affect anyone, which makes this a safe step to review. Who: Purview admin. Produces: Segments and inactive policies matching the matrix. ### Decisions 3. **Decision: All barriers at once, or one at a time?** Applying policies covers every active policy, so you control the pace by activating them. Activating one barrier's pair of policies, applying, and verifying before the next keeps each change small. Application starts about 30 minutes after you run it and processes about 5,000 accounts an hour, so schedule it and freeze membership changes for those teams meanwhile. Options: All barriers at once; One barrier at a time, highest-risk rule first. Recommended default: One barrier at a time, highest-risk rule first. Who: Compliance lead with the Purview admin. Produces: An order of barriers and dates. ### Pilot configuration 4. **Apply the first barrier and verify** Activate the first pair of policies, apply them, and check the application status until it's complete. Then check a few pairs of people on each side, using the relationship check Learn describes, which shows each person's attribute values and the policies applied, and rerun the matrix rows for that barrier. Compare team membership with the export, and confirm the owners heard about removals before they noticed them. Who: Purview admin. Produces: The first barrier live and verified. 5. **Move existing teams to Implicit** Teams created before barriers were enabled stay in Open mode, where no policy applies; new teams default to Implicit. Microsoft says to move existing teams to Implicit and provides a script. The policy application then removes members who don't fit. When you change the mode of a team-connected group, update its SharePoint site's mode to match. Use Owner Moderated mode only where an owner must legitimately bring incompatible segments together, and record why. Who: Teams admin. Produces: Existing teams in Implicit, with exceptions recorded. ### Production configuration 6. **Turn on barriers in SharePoint and OneDrive** Barriers don't reach the SharePoint site behind a team, or OneDrive, until you turn them on, and Learn asks you to wait 24 hours after activating policies first. Within 24 hours, team sites move to Implicit and follow team membership. Existing private channel sites stay Open until you set them to Implicit, and app-only apps need the tenant setting tested in Prepare. With Multi-Geo, turn barriers on in each geography. People who had access before can still see those sites in search and Copilot results but are denied when they open the content, so tell the service desk to expect it. Who: SharePoint admin. Produces: Barriers on in SharePoint and OneDrive, with private channel sites updated. 7. **Give sensitive sites their segments** Sites created by a segmented person are associated with their segment automatically; sites created in the admin center start Open. For sites that hold one group's protected information, associate the segment so only that segment can access and share it. A site can hold up to 100 compatible segments, and owners can add segments but only admins can remove them. Explicit sites turn off Anyone and company-wide sharing links, and people outside the site's segments see an error instead of the content. Owner Moderated mode can't be set on a site that has segments; remove them first. Who: SharePoint admin with site owners. Produces: Sensitive sites in Explicit mode. 8. **Keep group sites compliant** For Microsoft 365 group sites without a team, turn on the compliance assistant (in preview), which checks daily and removes members and owners who don't match the site's segments. Turning it on creates an enterprise application that needs admin consent, so involve whoever approves app consent; its removals appear in the audit log. Team-connected sites are kept compliant through team membership instead. Who: SharePoint admin. Produces: Compliance assistant running and its removals audited. 9. **Widen barrier by barrier, then hand over** Repeat for each remaining barrier, adjusting briefings from what each one taught you. When the last barrier is verified, hand over the register, matrix, exceptions, runbooks, the order barriers were applied in and the membership exports, which Maintain uses to explain past removals, to the people who'll own them. Who: Compliance lead. Produces: All barriers live and an agreed operating rhythm. 10. **Make it enforceable** Active policies, Implicit team mode and SharePoint barriers enforce the separation in Teams, SharePoint and OneDrive, and blocked people can't find each other. Email isn't covered; that's the mail flow rules in Go further. _Partly enforced. The gaps are a risk until a mechanism covers them._ ## 4. Pilot to production **Rollout approach:** By risk tier (Pilot size: One barrier, ideally between two small segments). Each barrier enforces a different rule. Starting with the highest-risk rule delivers the protection that matters most first and keeps each change small enough to verify. 1. **First barrier** (Change: Inform) Activate, apply and verify one pair of policies. Move on when: Application complete and matrix rows pass. 2. **Existing teams to Implicit** (Change: Explain) Run the mode change and brief owners of teams that lose members. Move on when: No affected team left in Open mode. 3. **SharePoint and OneDrive** (Change: Explain) Turn on barriers after the 24-hour wait and update private channel sites. Move on when: Team sites follow membership. 4. **Sensitive sites** Associate segments and turn on the compliance assistant. Move on when: Sensitive sites in Explicit mode. 5. **Remaining barriers** One at a time, highest risk first. Move on when: Every barrier verified. 6. **Hand over** (Change: Sustain) Operations owns barriers and the review rhythm. Move on when: The Maintain rhythm has started. ## 5. Common challenges - **If you** Apply every barrier at once. What tends to happen: One wrong segment removes people from teams across the organization.. A better approach: Activate one barrier at a time and verify before the next. - **If you** Leave existing teams in Open mode. What tends to happen: The barrier holds for new teams while old ones still mix both groups.. A better approach: Move existing teams to Implicit as part of each barrier. - **If you** Stop at Teams. What tends to happen: Files behind a team, other sites and OneDrive remain reachable.. A better approach: Turn on SharePoint and OneDrive barriers and update private channel sites. - **If you** Let owners find out from missing members. What tends to happen: Incidents and escalations replace a planned change.. A better approach: Brief each owner before their team is processed. ## 6. Checkpoints **Pilot:** - [ ] Did the first barrier complete and pass its matrix rows? - [ ] Were owners told before members were removed? **Production:** - [ ] Are all affected teams in Implicit mode, with exceptions recorded? - [ ] Are SharePoint and OneDrive barriers on, including private channel sites? - [ ] Is the compliance assistant running? - [ ] Has operations taken over? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Barriers applied and verified (Where you see it: Rollout tracker; Good direction: Up) - Affected teams still in Open mode (Where you see it: Teams mode export; Good direction: Down) - Barrier-related tickets per barrier (Where you see it: Service desk; Good direction: Down) **Ready-to-use text: Owner notice** > Your team [name] includes people from groups that our [rule] requires to be kept apart. On [date], [names] will be removed from the team because of that rule. After that, they won't see the team's conversations. If you need to work across this barrier, contact [compliance contact] before [date]. ## 8. Additional reading **Configure:** - [Get started with Information Barriers](https://learn.microsoft.com/en-us/purview/information-barriers-policies) - [Information Barriers in Microsoft Teams](https://learn.microsoft.com/en-us/purview/information-barriers-teams) - [Change Information Barriers modes with a PowerShell script](https://learn.microsoft.com/en-us/purview/information-barriers-teams-powershell-script) - [Use Information Barriers with SharePoint](https://learn.microsoft.com/en-us/purview/information-barriers-sharepoint) - [Use Information Barriers with OneDrive](https://learn.microsoft.com/en-us/purview/information-barriers-onedrive) - [Information Barriers compliance assistant (preview)](https://learn.microsoft.com/en-us/purview/information-barriers-sharepoint-assistant) - [Information Barriers and shared channels](https://learn.microsoft.com/en-us/purview/information-barriers-teams-shared-channels) ## Changelog - Version 1, 2026-10-16, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-16.