# Test barriers and get ready to apply them - URL: https://m365playbooks.com/playbooks/test-barriers-and-get-ready-to-apply-them/ - Topic: Information barriers (Program) - Product: Purview, Teams, SharePoint, OneDrive - Stage: Prepare - Last reviewed: October 16, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Prove the barriers do what the rule requires, and nothing more, before anyone is removed from a team. Applying policies changes membership and chats across the organization, and stopping an application doesn't undo what has already been applied. Clean directory data, the right tenant settings, a tested matrix and a written rollback are what make Deploy a controlled step instead of a surprise. ## 2. Overview Clean directory data, required tenant settings, a test of every way people communicate, a rollback plan and a go/no-go before policies apply. - Effort: About 10 to 15 person-days - Duration: 3 to 6 weeks - Complexity: Medium - Who's in the room: Purview admin, Teams admin, SharePoint admin, Exchange admin, owner of directory data, service desk lead, compliance lead - Beyond E5: Nothing beyond Microsoft 365 E5 - Risk of not doing it: Untested barriers remove the wrong people from teams, hide address lists or block meeting attendees, and the fix takes as long as the original application. ## 3. Key activities ### Prerequisites 1. **Fix the directory data** Correct every blank or unexpected value in the segment attribute for people in scope, and agree with HR or the system that feeds Microsoft Entra ID how moves will update it from now on. Segments include only people whose values match the filter, so Microsoft's guidance is to fill attributes before defining segments. A barrier is only as accurate as the attribute behind it. Who: Owner of directory data. Produces: No in-scope person with a missing or wrong value. 2. **Turn on scoped directory search early** Teams must scope directory search before you define the first policy, and Learn asks you to wait at least 24 hours after turning it on. It also hides the team search box and the public team listing, and turns off joining a team with /join. Tell people before it changes, so it isn't mistaken for a fault. Who: Teams admin. Produces: Scoped search on, with people told what changed. 3. **Check address books, audit and roles** Audit must be on to see the status of a policy application. Give administrators the IB Compliance Management role rather than Global Administrator. In Legacy mode, remove existing address book policies first. In the newer modes, Microsoft warns that enabling barriers where no address book policies exist can cost people address list visibility, so test what people see in Outlook as part of the matrix. Who: Purview admin with the Exchange admin. Produces: Prerequisites confirmed and recorded. ### Decisions 4. **Decision: Where do you test?** Policy application covers the whole tenant, so you can't scope it to a test group. A test tenant is safest for settings; in production, you can define pilot segments from membership of small pilot groups, so only those people are affected until you widen the definition. Options: Production only, with real segments; A test tenant first, then pilot segments in production. Recommended default: A test tenant first, then pilot segments in production. Who: Purview admin. Produces: A test approach. 5. **Decision: What's the rollback?** Stopping a policy application isn't instant and doesn't undo policies already applied. Rolling back means setting policies inactive and applying again, at roughly 5,000 accounts an hour, and SharePoint and OneDrive barriers can be suspended separately. Write down the steps, who decides, and how you'd restore team membership from an export taken beforehand. Options: Work it out if something goes wrong; Write and rehearse the rollback before applying. Recommended default: Write and rehearse the rollback before applying. Who: Purview admin with the compliance lead. Produces: A written rollback plan with a decision owner. ### Pilot configuration 6. **Run the test matrix** Test every way people connect: search, one-to-one and group chat, adding to a team, meeting invitations and joining, screen sharing, calls, file sharing and sharing links, Planner assignments, shared channels and guests. Include the known limits: channel meetings that non-members can't join, large meetings where the 1,000-person chat roster fills, and apps that use app-only access to SharePoint, which need a tenant setting to reach sites with barriers. Date each result, because service updates change behaviour and you'll retest. Run each scenario in both directions, since policies work one way, and with an unsegmented person, who should still reach both sides. Who: Purview admin with the Teams and SharePoint admins. Produces: A completed matrix with results and fixes. 7. **Export what will change** Export the membership of every team and Microsoft 365 group on the impact list, and the owners of affected sites. It's your evidence of what changed, your rollback source, and the list of people to brief. Add recurring meetings with large or mixed audiences: anyone who joins once stays on the meeting chat roster for later occurrences, so the 1,000-person limit fills faster than attendance suggests. For large audiences, a town hall is the better fit. Who: Teams admin. Produces: Membership exports for affected teams and groups. ### Production configuration 8. **Brief owners, people and the service desk** Tell each affected owner which members will be removed and why, and tell people in segments what they'll no longer see: blocked colleagues disappear from search, suggested contacts and the people picker, and org charts and people cards show an error instead, which people can mistake for someone having left. Give the service desk the troubleshooting steps Microsoft publishes, starting with checking whether a user is covered by a policy, so blocked contact isn't logged as a Teams fault. Who: Compliance lead with the service desk lead. Produces: Owners, people and the service desk briefed. 9. **Hold the go/no-go** Review the matrix, data quality, rollback plan and briefings with the compliance lead and rule owners. Include the email decision: if mail flow rules are part of the design, they should be tested and ready to enforce with the first barrier. Go means no blocking issue is open and the data is clean; no-go means a dated list of what must change. Who: Compliance lead. Produces: A recorded go/no-go decision. 10. **Make it enforceable** Policies stay inactive, and pilot segments contain only pilot groups, until the go/no-go is signed. Policy state is the mechanism; the signed checklist is the gate. _Enforced by a mechanism._ ## 4. Test to sign-off 1. **Prepare data and settings** (Change: Inform) Attribute fixed, scoped search on, prerequisites confirmed. Move on when: Data and settings are ready. 2. **Test in the test tenant** Run the matrix against the designed policies. Move on when: Every row has a result. 3. **Pilot segments in production** (Change: Explain) Apply barriers for small pilot groups only. Move on when: Pilot results match the test tenant. 4. **Go/no-go** (Change: Inform) Owners review results, rollback and briefings. Move on when: No blocking issue is open. ## 5. Common challenges - **If you** Skip the wait after scoped directory search. What tends to happen: Barriers behave inconsistently in Teams during the first applications.. A better approach: Turn scoped search on early and wait at least 24 hours. - **If you** Leave address books untested. What tends to happen: People open Outlook and can't find colleagues they're allowed to email.. A better approach: Test address list visibility in the matrix. - **If you** Test chat and nothing else. What tends to happen: Meetings, channel meetings or app-only apps fail on day one.. A better approach: Cover every way people connect, including the documented limits. - **If you** Plan no rollback. What tends to happen: A wrong segment removes people from teams, and nobody knows how to restore them.. A better approach: Export membership and write the rollback before applying. - **If you** Surprise team owners. What tends to happen: Owners see members vanish and raise incidents.. A better approach: Brief each affected owner with the names and the reason. ## 6. Checkpoints **Pilot:** - [ ] Is the segment attribute complete and correct for everyone in scope? - [ ] Has scoped directory search been on for at least 24 hours? - [ ] Did the matrix include meetings, address lists and app-only apps? **Production:** - [ ] Is the rollback written and owned? - [ ] Are affected owners and the service desk briefed? - [ ] Is the go/no-go recorded? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Test cases passed (Where you see it: Test matrix; Good direction: Up) - In-scope people with a missing or wrong attribute value (Where you see it: Microsoft Entra user export; Good direction: Down) - Open blocking issues (Where you see it: Test matrix; Good direction: Down) **Ready-to-use text: Test matrix (copy into a spreadsheet)** > Columns: Scenario | Segments | Expected | Result | Fix | Blocking (Y/N) | Owner. > Rows to start with: People search | One-to-one chat | Group chat | Add to a team | Meeting invitation and join | Channel meeting as a non-member | Large meeting near the chat roster limit | Screen share | Call | Share a file and open a sharing link | SharePoint site access by mode | OneDrive sharing | Planner assignment | Shared channel | Guest | Outlook address list | App-only app reaching a site. **Ready-to-use text: Go/no-go checklist** > 1. Attribute complete and correct. 2. Scoped directory search on for 24 hours or more. 3. No blocking issue open. 4. Membership exported. 5. Rollback written with a decision owner. 6. Owners, people and service desk briefed. ## 8. Additional reading **Configure:** - [Get started with Information Barriers](https://learn.microsoft.com/en-us/purview/information-barriers-policies) - [Limit who users can see when searching the directory in Teams](https://learn.microsoft.com/en-us/microsoftteams/teams-scoped-directory-search) - [Information Barriers in Microsoft Teams](https://learn.microsoft.com/en-us/purview/information-barriers-teams) - [Use Information Barriers with SharePoint](https://learn.microsoft.com/en-us/purview/information-barriers-sharepoint) **Monitor:** - [Manage Information Barriers policies](https://learn.microsoft.com/en-us/purview/information-barriers-edit-segments-policies) - [Resolve communication issues in Information Barriers](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/information-barriers/information-barriers-troubleshooting) ## Changelog - Version 1, 2026-10-16, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-16.