# Keep barriers accurate as people move - URL: https://m365playbooks.com/playbooks/keep-barriers-accurate-as-people-move/ - Topic: Information barriers (Program) - Product: Purview, Teams, SharePoint, OneDrive - Stage: Maintain - Last reviewed: October 16, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Keep each barrier matched to its rule as people change jobs and the organization changes shape. Barriers depend on directory data, and every move, new team and policy change shifts who can talk to whom. A light, regular rhythm catches drift before it becomes either a gap in the barrier or a colleague cut off for no reason. ## 2. Overview Owners, mover handling, exception requests, checks after every change, and a yearly review of each barrier against its rule. - Effort: About 1 to 2 person-days a month - Duration: Ongoing - Complexity: Medium - Who's in the room: Compliance lead (owner), Purview admin, owner of directory data, Teams admin, SharePoint admin, service desk - Beyond E5: Nothing beyond Microsoft 365 E5 - Risk of not doing it: Attributes drift and exceptions pile up, so the barrier either leaks or blocks people who should be working together, and nobody can show it still matches the rule. ## 3. Key activities ### Prerequisites 1. **Name the owners** The compliance lead owns the register and policies, the owner of directory data owns the segment attribute, the Teams admin owns team modes, and the SharePoint admin owns site segments. Write it into the operating rhythm so the role survives staff changes. Keep the IB Compliance Management role to the few people who change policies, and review who holds it each year. Who: Compliance lead. Produces: Named owners in the operating rhythm. 2. **Handle movers deliberately** When a person's attribute changes, the barrier evaluation follows: they can be removed from group chats and teams, and their one-to-one chats with newly blocked people become read-only. Removed team members can't see or take part in the team's existing or new conversations. Make the HR move process tell the person and their new and old managers what will change, on the day it changes. Who: Owner of directory data with HR. Produces: A mover step in the HR process. ### Decisions 3. **Decision: How do you handle exception requests?** People will ask to work across a barrier. Changing a policy for each request erodes the rule and changes it for everyone. An Owner Moderated team or site, approved by the rule's owner and reviewed, allows the collaboration without changing the policy. Options: Change policies for each request; Use approved Owner Moderated teams and sites, reviewed regularly. Recommended default: Use approved Owner Moderated teams and sites, reviewed regularly. Who: Compliance lead. Produces: An exception process with approvals recorded. ### Pilot configuration 4. **Test every policy change first** Treat a change to a segment or policy like the original rollout: update the design, test it in the test tenant or with pilot segments, and brief affected owners. A policy's type can't be changed in place; changing it means a new policy. Removing a segment has an order: set its policy inactive and remove it, change the segment's filter so it matches nobody, apply policies with group cleanup, and only then remove the segment. Who: Purview admin. Produces: Tested, recorded changes. ### Production configuration 5. **After every change, apply and check** Apply policies after any segment or policy change and follow the status until it completes; large organizations can take 24 hours or more. Then run the SharePoint policy compliance report, which lists sites whose segments are no longer compatible. Admins fix Explicit sites; for Implicit sites, the team's membership has to change. The report can also update non-compliant OneDrive accounts as it runs, which saves fixing them one by one. Schedule changes like a release, with affected owners told in advance, since an applied change reaches everyone in the segments at once. Who: Purview admin with the SharePoint admin. Produces: Completed application and a clean compliance report. 6. **Monthly: check status and audit events** Check the latest policy application, the audit events for site segment and mode changes, and the compliance assistant's removals. The compliance assistant runs every 24 hours, and its audit events record each member or owner removed and each group found non-compliant. Sample a few people with recent moves to confirm they landed in the right segment. Who: Purview admin. Produces: A monthly check log. 7. **Quarterly: review modes and exceptions** Run the insights report (in preview), which shows mode distribution and the most active sites by mode, and look for teams and private channel sites still Open that should be Implicit. The report can be created once every 24 hours and replaces the previous one, so export what you want to keep. Review every Owner Moderated exception with its approver and close those no longer needed. Include shared channels: barriers decide who can be added to a team with shared channels and which teams a channel can be shared with, so owners hit them there first. Who: Teams admin with the SharePoint admin. Produces: Mode review and an updated exception list. 8. **Support people who are blocked** Typical reports are a colleague who can't be found, can be found but not selected, or can't be messaged in Teams. Give the service desk a short runbook: check whether the person is covered by a policy, which policy applies, and whether their segment is right. Most tickets turn out to be the barrier working as designed, or a wrong attribute value. Who: Service desk lead. Produces: A runbook and a route to the Purview admin. 9. **Yearly: review each barrier against its rule** With each rule's owner, confirm the rule still applies and the segments still match it. Retire barriers that no longer have a rule, and watch for changes in your mode's capabilities, such as an upgrade path out of Legacy mode. Check licences at the same time: people in a policy's assigned segment need a licence that includes information barriers. Who: Compliance lead. Produces: A signed yearly review. 10. **Make it enforceable** Policies, team and site modes, and the compliance assistant keep enforcing the barriers; the reviews keep them matched to their rules. _Enforced by a mechanism._ ## 4. Operating rhythm 1. **After every change** Apply, follow the status and run the compliance report. Move on when: Application complete and report clean. 2. **Monthly** Check status, audit events and recent movers. Move on when: No unexplained removals or wrong segments. 3. **Quarterly** (Change: Sustain) Review modes and exceptions. Move on when: No stale exceptions or open teams that should be Implicit. 4. **Yearly** (Change: Sustain) Review each barrier with its rule owner. Move on when: Every barrier still has a rule. ## 5. Common challenges - **If you** Let the attribute drift. What tends to happen: Movers keep their old segment, and the barrier leaks or blocks the wrong people.. A better approach: Build the mover step into the HR process and sample movers monthly. - **If you** Change a policy without the compliance report. What tends to happen: Sites keep segments that are no longer compatible.. A better approach: Run the report after every policy change and fix what it lists. - **If you** Grant exceptions by loosening policies. What tends to happen: The rule erodes for everyone, one request at a time.. A better approach: Use approved Owner Moderated teams and sites and review them quarterly. - **If you** Treat every block as a fault. What tends to happen: The service desk escalates barriers working as designed, and someone loosens a policy to make the ticket go away.. A better approach: Give the service desk the runbook and route policy questions to the compliance lead. - **If you** Keep barriers nobody needs. What tends to happen: People stay cut off long after the rule ended.. A better approach: Review each barrier with its rule owner yearly and retire what's no longer required. ## 6. Checkpoints **Pilot:** - [ ] Is every policy change tested and recorded in the design? - [ ] Are exceptions approved by the rule's owner? **Production:** - [ ] Is the compliance report run after every policy change? - [ ] Are movers sampled monthly? - [ ] Has every barrier been reviewed against its rule this year? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - People with a missing or wrong segment attribute (Where you see it: Microsoft Entra user export; Good direction: Down) - Sites listed as non-compliant (Where you see it: Information Barriers policy compliance report; Good direction: Down) - Open Owner Moderated exceptions (Where you see it: Exception list; Good direction: Steady) - Barriers reviewed against their rule this year (Where you see it: Barrier register; Good direction: Up) **Ready-to-use text: Mover message** > From [date], your role moves to [new group]. Because of [rule], you'll no longer be able to chat, meet or share files with [groups]. You'll keep read-only access to past one-to-one chats. Questions: [contact]. **Ready-to-use text: Exception request** > Requester | Teams or site | Segments to bring together | Reason | Rule owner approval | Owner Moderated owner | Review date. ## 8. Additional reading **Configure:** - [Information Barriers compliance assistant (preview)](https://learn.microsoft.com/en-us/purview/information-barriers-sharepoint-assistant) **Monitor:** - [Manage Information Barriers policies](https://learn.microsoft.com/en-us/purview/information-barriers-edit-segments-policies) - [Create an Information Barriers policy compliance report](https://learn.microsoft.com/en-us/purview/information-barriers-sharepoint-report) - [SharePoint and OneDrive insights report (preview)](https://learn.microsoft.com/en-us/purview/information-barriers-insights-report) - [Resolve communication issues in Information Barriers](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/information-barriers/information-barriers-troubleshooting) ## Changelog - Version 1, 2026-10-16, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-16.