M365 PlaybooksPurview · Teams · SharePoint · OneDrive· Deploy · Exchange email
Restrict email between segments with mail flow rules
Purpose
Close the gap information barriers leave in email, the channel most conflict-of-interest questions start with. Barriers don't restrict Exchange Online email, so where a rule requires that two groups don't email each other, Microsoft points to mail flow rules. Built from the same groups as the segments, they keep email consistent with Teams, SharePoint and OneDrive.
Overview
Mail flow rules that reject email between segments a rule keeps apart, built from groups that match the segments and tested before enforcement.
- Effort
- About 2 to 4 person-days
- Duration
- 2 to 3 weeks
- Complexity
- Low
- Who's in the room
- Exchange admin, Purview admin, compliance lead, owner of directory data
Risk of not doing it
Leadership believes the barrier covers email when it doesn't, and the first conflict-of-interest question finds messages that should never have been sent.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Keep a mail-enabled group for each segment
Mail flow rules can check whether a sender or recipient is a member of a distribution group, mail-enabled security group or Microsoft 365 group. Keep one such group per segment that needs email restrictions, maintained from the same source as the segment attribute, so the two never disagree.
Decisions
Decision: Reject with an explanation, or delete silently?
A rule can reject a message with an explanation in the bounce, or delete it without telling anyone. An explanation tells the sender why, which prevents repeated attempts and support tickets.
Options
- Delete the message silently
- Reject with an explanation that names the rule
Recommended default: Reject with an explanation that names the rule
Pilot configuration
Write one rule per direction
Like barrier policies, each rule covers one direction: sender in one group, recipient in the other. Mirror the barrier matrix, so each blocked pair has two rules, and name each rule after the barrier it supports.
Test before enforcing
Create the rules in a test mode, which doesn't affect delivery, with or without a Policy Tip shown to senders. Allow up to 30 minutes for a new or changed rule to apply, then check results with message trace before switching to enforce. If other rules stop processing later rules, check the order so these rules are reached.
Production configuration
Enforce and review with the barriers
Switch each rule to enforce alongside its barrier in the Deploy order. Add the rules and their groups to the Maintain reviews, so a segment change is matched in email the same day.
Make it enforceable
Enforced mail flow rules reject email between the groups, with an explanation, in both directions.
Enforced by a mechanism.
Pilot to production
Rollout approachBy risk tier · Pilot size: The rules for the first barrier
Each rule follows its barrier into production, highest-risk rule first, so email and Teams are never out of step for long.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Test without notice
Rules log matches without affecting delivery.
Move on when: Matches are the expected senders and recipients
Test with Policy TipsChange: Inform
Senders see a note before they send.
Move on when: No unexpected matches
Enforce with the barrierChange: Explain
Rules reject email alongside each barrier.
Move on when: Barrier and email rules agree
Common challenges
If youAssume barriers cover email
What tends to happenEmail between the groups continues unnoticed.
A better approachAdd mail flow rules wherever the rule covers email.
If youMaintain groups separately from segments
What tends to happenEmail and Teams disagree about who's on which side.
A better approachFeed both from the same source and check them together.
If youWrite a rule for one direction only
What tends to happenOne group can still email the other.
A better approachCreate two rules for every barrier.
Checkpoints
Pilot
- Does every blocked pair have two rules?
- Were the rules tested before enforcement?
Production
- Do the groups match the segments?
- Are the rules part of the Maintain reviews?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Messages rejected by the rules | Message trace | Steady |
| Differences between groups and segments | Monthly membership comparison | Down |
Ready-to-use text
Rejection text
This message wasn't delivered because [rule] doesn't allow email between [group] and [group]. If you think this is wrong, contact [compliance contact].
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-16. |