# Restrict email between segments with mail flow rules - URL: https://m365playbooks.com/playbooks/restrict-email-between-segments-with-mail-flow-rules/ - Topic: Information barriers (Program) - Product: Purview, Teams, SharePoint, OneDrive - Stage: Deploy - Last reviewed: October 16, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Close the gap information barriers leave in email, the channel most conflict-of-interest questions start with. Barriers don't restrict Exchange Online email, so where a rule requires that two groups don't email each other, Microsoft points to mail flow rules. Built from the same groups as the segments, they keep email consistent with Teams, SharePoint and OneDrive. ## 2. Overview Mail flow rules that reject email between segments a rule keeps apart, built from groups that match the segments and tested before enforcement. - Effort: About 2 to 4 person-days - Duration: 2 to 3 weeks - Complexity: Low - Who's in the room: Exchange admin, Purview admin, compliance lead, owner of directory data - Beyond E5: Nothing beyond Microsoft 365 E5 - Risk of not doing it: Leadership believes the barrier covers email when it doesn't, and the first conflict-of-interest question finds messages that should never have been sent. ## 3. Key activities ### Prerequisites 1. **Keep a mail-enabled group for each segment** Mail flow rules can check whether a sender or recipient is a member of a distribution group, mail-enabled security group or Microsoft 365 group. Keep one such group per segment that needs email restrictions, maintained from the same source as the segment attribute, so the two never disagree. Who: Owner of directory data. Produces: A group per segment, in step with the segment. ### Decisions 2. **Decision: Reject with an explanation, or delete silently?** A rule can reject a message with an explanation in the bounce, or delete it without telling anyone. An explanation tells the sender why, which prevents repeated attempts and support tickets. Options: Delete the message silently; Reject with an explanation that names the rule. Recommended default: Reject with an explanation that names the rule. Who: Compliance lead. Produces: An action for the rules. ### Pilot configuration 3. **Write one rule per direction** Like barrier policies, each rule covers one direction: sender in one group, recipient in the other. Mirror the barrier matrix, so each blocked pair has two rules, and name each rule after the barrier it supports. Who: Exchange admin. Produces: Rules matching the barrier matrix. 4. **Test before enforcing** Create the rules in a test mode, which doesn't affect delivery, with or without a Policy Tip shown to senders. Allow up to 30 minutes for a new or changed rule to apply, then check results with message trace before switching to enforce. If other rules stop processing later rules, check the order so these rules are reached. Who: Exchange admin. Produces: Tested rules ready to enforce. ### Production configuration 5. **Enforce and review with the barriers** Switch each rule to enforce alongside its barrier in the Deploy order. Add the rules and their groups to the Maintain reviews, so a segment change is matched in email the same day. Who: Exchange admin with the compliance lead. Produces: Enforced rules in the Maintain rhythm. 6. **Make it enforceable** Enforced mail flow rules reject email between the groups, with an explanation, in both directions. _Enforced by a mechanism._ ## 4. Pilot to production **Rollout approach:** By risk tier (Pilot size: The rules for the first barrier). Each rule follows its barrier into production, highest-risk rule first, so email and Teams are never out of step for long. 1. **Test without notice** Rules log matches without affecting delivery. Move on when: Matches are the expected senders and recipients. 2. **Test with Policy Tips** (Change: Inform) Senders see a note before they send. Move on when: No unexpected matches. 3. **Enforce with the barrier** (Change: Explain) Rules reject email alongside each barrier. Move on when: Barrier and email rules agree. ## 5. Common challenges - **If you** Assume barriers cover email. What tends to happen: Email between the groups continues unnoticed.. A better approach: Add mail flow rules wherever the rule covers email. - **If you** Maintain groups separately from segments. What tends to happen: Email and Teams disagree about who's on which side.. A better approach: Feed both from the same source and check them together. - **If you** Write a rule for one direction only. What tends to happen: One group can still email the other.. A better approach: Create two rules for every barrier. ## 6. Checkpoints **Pilot:** - [ ] Does every blocked pair have two rules? - [ ] Were the rules tested before enforcement? **Production:** - [ ] Do the groups match the segments? - [ ] Are the rules part of the Maintain reviews? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Messages rejected by the rules (Where you see it: Message trace; Good direction: Steady) - Differences between groups and segments (Where you see it: Monthly membership comparison; Good direction: Down) **Ready-to-use text: Rejection text** > This message wasn't delivered because [rule] doesn't allow email between [group] and [group]. If you think this is wrong, contact [compliance contact]. ## 8. Additional reading **Plan:** - [Learn about Information Barriers](https://learn.microsoft.com/en-us/purview/information-barriers) - [Mail flow rules (transport rules) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules) **Configure:** - [Mail flow rule conditions and exceptions (predicates) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions) - [Mail flow rule actions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rule-actions) ## Changelog - Version 1, 2026-10-16, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-16.