M365 PlaybooksPurview · Teams · SharePoint · OneDrive· Maintain
Keep barriers accurate as people move
Purpose
Keep each barrier matched to its rule as people change jobs and the organization changes shape. Barriers depend on directory data, and every move, new team and policy change shifts who can talk to whom. A light, regular rhythm catches drift before it becomes either a gap in the barrier or a colleague cut off for no reason.
Overview
Owners, mover handling, exception requests, checks after every change, and a yearly review of each barrier against its rule.
- Effort
- About 1 to 2 person-days a month
- Duration
- Ongoing
- Complexity
- Medium
- Who's in the room
- Compliance lead (owner), Purview admin, owner of directory data, Teams admin, SharePoint admin, service desk
Risk of not doing it
Attributes drift and exceptions pile up, so the barrier either leaks or blocks people who should be working together, and nobody can show it still matches the rule.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Name the owners
The compliance lead owns the register and policies, the owner of directory data owns the segment attribute, the Teams admin owns team modes, and the SharePoint admin owns site segments. Write it into the operating rhythm so the role survives staff changes. Keep the IB Compliance Management role to the few people who change policies, and review who holds it each year.
Handle movers deliberately
When a person's attribute changes, the barrier evaluation follows: they can be removed from group chats and teams, and their one-to-one chats with newly blocked people become read-only. Removed team members can't see or take part in the team's existing or new conversations. Make the HR move process tell the person and their new and old managers what will change, on the day it changes.
Decisions
Decision: How do you handle exception requests?
People will ask to work across a barrier. Changing a policy for each request erodes the rule and changes it for everyone. An Owner Moderated team or site, approved by the rule's owner and reviewed, allows the collaboration without changing the policy.
Options
- Change policies for each request
- Use approved Owner Moderated teams and sites, reviewed regularly
Recommended default: Use approved Owner Moderated teams and sites, reviewed regularly
Pilot configuration
Test every policy change first
Treat a change to a segment or policy like the original rollout: update the design, test it in the test tenant or with pilot segments, and brief affected owners. A policy's type can't be changed in place; changing it means a new policy. Removing a segment has an order: set its policy inactive and remove it, change the segment's filter so it matches nobody, apply policies with group cleanup, and only then remove the segment.
Production configuration
After every change, apply and check
Apply policies after any segment or policy change and follow the status until it completes; large organizations can take 24 hours or more. Then run the SharePoint policy compliance report, which lists sites whose segments are no longer compatible. Admins fix Explicit sites; for Implicit sites, the team's membership has to change. The report can also update non-compliant OneDrive accounts as it runs, which saves fixing them one by one. Schedule changes like a release, with affected owners told in advance, since an applied change reaches everyone in the segments at once.
Monthly: check status and audit events
Check the latest policy application, the audit events for site segment and mode changes, and the compliance assistant's removals. The compliance assistant runs every 24 hours, and its audit events record each member or owner removed and each group found non-compliant. Sample a few people with recent moves to confirm they landed in the right segment.
Quarterly: review modes and exceptions
Run the insights report (in preview), which shows mode distribution and the most active sites by mode, and look for teams and private channel sites still Open that should be Implicit. The report can be created once every 24 hours and replaces the previous one, so export what you want to keep. Review every Owner Moderated exception with its approver and close those no longer needed. Include shared channels: barriers decide who can be added to a team with shared channels and which teams a channel can be shared with, so owners hit them there first.
Support people who are blocked
Typical reports are a colleague who can't be found, can be found but not selected, or can't be messaged in Teams. Give the service desk a short runbook: check whether the person is covered by a policy, which policy applies, and whether their segment is right. Most tickets turn out to be the barrier working as designed, or a wrong attribute value.
Yearly: review each barrier against its rule
With each rule's owner, confirm the rule still applies and the segments still match it. Retire barriers that no longer have a rule, and watch for changes in your mode's capabilities, such as an upgrade path out of Legacy mode. Check licences at the same time: people in a policy's assigned segment need a licence that includes information barriers.
Make it enforceable
Policies, team and site modes, and the compliance assistant keep enforcing the barriers; the reviews keep them matched to their rules.
Enforced by a mechanism.
Operating rhythm
After every change
Apply, follow the status and run the compliance report.
Move on when: Application complete and report clean
Monthly
Check status, audit events and recent movers.
Move on when: No unexplained removals or wrong segments
QuarterlyChange: Sustain
Review modes and exceptions.
Move on when: No stale exceptions or open teams that should be Implicit
YearlyChange: Sustain
Review each barrier with its rule owner.
Move on when: Every barrier still has a rule
Common challenges
If youLet the attribute drift
What tends to happenMovers keep their old segment, and the barrier leaks or blocks the wrong people.
A better approachBuild the mover step into the HR process and sample movers monthly.
If youChange a policy without the compliance report
What tends to happenSites keep segments that are no longer compatible.
A better approachRun the report after every policy change and fix what it lists.
If youGrant exceptions by loosening policies
What tends to happenThe rule erodes for everyone, one request at a time.
A better approachUse approved Owner Moderated teams and sites and review them quarterly.
If youTreat every block as a fault
What tends to happenThe service desk escalates barriers working as designed, and someone loosens a policy to make the ticket go away.
A better approachGive the service desk the runbook and route policy questions to the compliance lead.
If youKeep barriers nobody needs
What tends to happenPeople stay cut off long after the rule ended.
A better approachReview each barrier with its rule owner yearly and retire what's no longer required.
Checkpoints
Pilot
- Is every policy change tested and recorded in the design?
- Are exceptions approved by the rule's owner?
Production
- Is the compliance report run after every policy change?
- Are movers sampled monthly?
- Has every barrier been reviewed against its rule this year?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| People with a missing or wrong segment attribute | Microsoft Entra user export | Down |
| Sites listed as non-compliant | Information Barriers policy compliance report | Down |
| Open Owner Moderated exceptions | Exception list | Steady |
| Barriers reviewed against their rule this year | Barrier register | Up |
Ready-to-use text
Mover message
From [date], your role moves to [new group]. Because of [rule], you'll no longer be able to chat, meet or share files with [groups]. You'll keep read-only access to past one-to-one chats. Questions: [contact].
Exception request
Requester | Teams or site | Segments to bring together | Reason | Rule owner approval | Owner Moderated owner | Review date.
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-16. |