M365 Playbooks

Purview · Teams · SharePoint · OneDrive· Deploy

Apply barriers across Teams, SharePoint and OneDrive

Written by

Last reviewed · Version 1 · 6 min read · Written for Microsoft 365 E5

Purpose

Turn the signed design into barriers that hold everywhere people work, one barrier at a time. Applying policies is only part of it: existing teams stay open until their mode changes, SharePoint and OneDrive need barriers turned on separately, and sensitive sites need their segments. Doing it barrier by barrier keeps each change small enough to check and explain.

Overview

Segments and policies created inactive, then activated barrier by barrier, with teams moved to Implicit and SharePoint and OneDrive barriers turned on.

Effort
About 10 to 20 person-days
Duration
4 to 8 weeks
Complexity
High
Who's in the room
Purview admin, Teams admin, SharePoint admin, compliance lead, service desk lead, owners of affected teams and sites

Risk of not doing it

Applied all at once, a mistake in one segment removes people from teams across the organization, and existing teams left open let the barrier be bypassed.

Key activities

The plan in order: what must be true first, what to decide, then how to configure the pilot and production.

Prerequisites

  1. Start from a signed go/no-go

    Deploy begins where Prepare ends: clean data, scoped directory search on, a tested matrix, membership exports, a rollback plan and briefed owners. If any is missing, finish it first.

    Who
    Compliance lead
    Produces
    A signed go/no-go

  2. Create segments and policies, inactive

    Create the segments from the matrix, then the policies, and leave every policy inactive. Segment names can't be changed later, so use the names from the design. Defining or editing inactive policies doesn't affect anyone, which makes this a safe step to review.

    Who
    Purview admin
    Produces
    Segments and inactive policies matching the matrix

Decisions

  1. Decision: All barriers at once, or one at a time?

    Applying policies covers every active policy, so you control the pace by activating them. Activating one barrier's pair of policies, applying, and verifying before the next keeps each change small. Application starts about 30 minutes after you run it and processes about 5,000 accounts an hour, so schedule it and freeze membership changes for those teams meanwhile.

    Options

    • All barriers at once
    • One barrier at a time, highest-risk rule first

    Recommended default: One barrier at a time, highest-risk rule first

    Who
    Compliance lead with the Purview admin
    Produces
    An order of barriers and dates

Pilot configuration

  1. Apply the first barrier and verify

    Activate the first pair of policies, apply them, and check the application status until it's complete. Then check a few pairs of people on each side, using the relationship check Learn describes, which shows each person's attribute values and the policies applied, and rerun the matrix rows for that barrier. Compare team membership with the export, and confirm the owners heard about removals before they noticed them.

    Who
    Purview admin
    Produces
    The first barrier live and verified

  2. Move existing teams to Implicit

    Teams created before barriers were enabled stay in Open mode, where no policy applies; new teams default to Implicit. Microsoft says to move existing teams to Implicit and provides a script. The policy application then removes members who don't fit. When you change the mode of a team-connected group, update its SharePoint site's mode to match. Use Owner Moderated mode only where an owner must legitimately bring incompatible segments together, and record why.

    Who
    Teams admin
    Produces
    Existing teams in Implicit, with exceptions recorded

Production configuration

  1. Turn on barriers in SharePoint and OneDrive

    Barriers don't reach the SharePoint site behind a team, or OneDrive, until you turn them on, and Learn asks you to wait 24 hours after activating policies first. Within 24 hours, team sites move to Implicit and follow team membership. Existing private channel sites stay Open until you set them to Implicit, and app-only apps need the tenant setting tested in Prepare. With Multi-Geo, turn barriers on in each geography. People who had access before can still see those sites in search and Copilot results but are denied when they open the content, so tell the service desk to expect it.

    Who
    SharePoint admin
    Produces
    Barriers on in SharePoint and OneDrive, with private channel sites updated

  2. Give sensitive sites their segments

    Sites created by a segmented person are associated with their segment automatically; sites created in the admin center start Open. For sites that hold one group's protected information, associate the segment so only that segment can access and share it. A site can hold up to 100 compatible segments, and owners can add segments but only admins can remove them. Explicit sites turn off Anyone and company-wide sharing links, and people outside the site's segments see an error instead of the content. Owner Moderated mode can't be set on a site that has segments; remove them first.

    Who
    SharePoint admin with site owners
    Produces
    Sensitive sites in Explicit mode

  3. Keep group sites compliant

    For Microsoft 365 group sites without a team, turn on the compliance assistant (in preview), which checks daily and removes members and owners who don't match the site's segments. Turning it on creates an enterprise application that needs admin consent, so involve whoever approves app consent; its removals appear in the audit log. Team-connected sites are kept compliant through team membership instead.

    Who
    SharePoint admin
    Produces
    Compliance assistant running and its removals audited

  4. Widen barrier by barrier, then hand over

    Repeat for each remaining barrier, adjusting briefings from what each one taught you. When the last barrier is verified, hand over the register, matrix, exceptions, runbooks, the order barriers were applied in and the membership exports, which Maintain uses to explain past removals, to the people who'll own them.

    Who
    Compliance lead
    Produces
    All barriers live and an agreed operating rhythm

  5. Make it enforceable

    Active policies, Implicit team mode and SharePoint barriers enforce the separation in Teams, SharePoint and OneDrive, and blocked people can't find each other. Email isn't covered; that's the mail flow rules in Go further.

    Partly enforced. The gaps are a risk until a mechanism covers them.

Pilot to production

Rollout approachBy risk tier · Pilot size: One barrier, ideally between two small segments

Each barrier enforces a different rule. Starting with the highest-risk rule delivers the protection that matters most first and keeps each change small enough to verify.

Make your pilot representative
  • Every major role, not only IT and enthusiasts
  • More than one location or time zone
  • Heavy users of the workload you are changing
  • People who handle sensitive information
  • At least one team you expect to be sceptical

  1. First barrierChange: Inform

    Activate, apply and verify one pair of policies.

    Move on when: Application complete and matrix rows pass

  2. Existing teams to ImplicitChange: Explain

    Run the mode change and brief owners of teams that lose members.

    Move on when: No affected team left in Open mode

  3. SharePoint and OneDriveChange: Explain

    Turn on barriers after the 24-hour wait and update private channel sites.

    Move on when: Team sites follow membership

  4. Sensitive sites

    Associate segments and turn on the compliance assistant.

    Move on when: Sensitive sites in Explicit mode

  5. Remaining barriers

    One at a time, highest risk first.

    Move on when: Every barrier verified

  6. Hand overChange: Sustain

    Operations owns barriers and the review rhythm.

    Move on when: The Maintain rhythm has started

Common challenges

  • If youApply every barrier at once

    What tends to happenOne wrong segment removes people from teams across the organization.

    A better approach

    Activate one barrier at a time and verify before the next.

  • If youLeave existing teams in Open mode

    What tends to happenThe barrier holds for new teams while old ones still mix both groups.

    A better approach

    Move existing teams to Implicit as part of each barrier.

  • If youStop at Teams

    What tends to happenFiles behind a team, other sites and OneDrive remain reachable.

    A better approach

    Turn on SharePoint and OneDrive barriers and update private channel sites.

  • If youLet owners find out from missing members

    What tends to happenIncidents and escalations replace a planned change.

    A better approach

    Brief each owner before their team is processed.

Checkpoints

Pilot

  • Did the first barrier complete and pass its matrix rows?
  • Were owners told before members were removed?

Production

  • Are all affected teams in Implicit mode, with exceptions recorded?
  • Are SharePoint and OneDrive barriers on, including private channel sites?
  • Is the compliance assistant running?
  • Has operations taken over?

Success measures

Capture a baseline before you start, or you won't be able to show the change.

MeasureWhere you see itGood direction
Barriers applied and verifiedRollout tracker Up
Affected teams still in Open modeTeams mode export Down
Barrier-related tickets per barrierService desk Down

Ready-to-use text

Owner notice
Your team [name] includes people from groups that our [rule] requires to be kept apart. On [date], [names] will be removed from the team because of that rule. After that, they won't see the team's conversations. If you need to work across this barrier, contact [compliance contact] before [date].

Additional reading

Changelog

Changelog (1 version)
Published versions of this playbook
VersionDateAuthorChange
1Sev DerghazarianFirst version. Facts checked against Microsoft Learn on 2026-10-16.