M365 PlaybooksPurview · Teams · SharePoint · OneDrive· Prepare
Test barriers and get ready to apply them
Purpose
Prove the barriers do what the rule requires, and nothing more, before anyone is removed from a team. Applying policies changes membership and chats across the organization, and stopping an application doesn't undo what has already been applied. Clean directory data, the right tenant settings, a tested matrix and a written rollback are what make Deploy a controlled step instead of a surprise.
Overview
Clean directory data, required tenant settings, a test of every way people communicate, a rollback plan and a go/no-go before policies apply.
- Effort
- About 10 to 15 person-days
- Duration
- 3 to 6 weeks
- Complexity
- Medium
- Who's in the room
- Purview admin, Teams admin, SharePoint admin, Exchange admin, owner of directory data, service desk lead, compliance lead
Risk of not doing it
Untested barriers remove the wrong people from teams, hide address lists or block meeting attendees, and the fix takes as long as the original application.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Fix the directory data
Correct every blank or unexpected value in the segment attribute for people in scope, and agree with HR or the system that feeds Microsoft Entra ID how moves will update it from now on. Segments include only people whose values match the filter, so Microsoft's guidance is to fill attributes before defining segments. A barrier is only as accurate as the attribute behind it.
Turn on scoped directory search early
Teams must scope directory search before you define the first policy, and Learn asks you to wait at least 24 hours after turning it on. It also hides the team search box and the public team listing, and turns off joining a team with /join. Tell people before it changes, so it isn't mistaken for a fault.
Check address books, audit and roles
Audit must be on to see the status of a policy application. Give administrators the IB Compliance Management role rather than Global Administrator. In Legacy mode, remove existing address book policies first. In the newer modes, Microsoft warns that enabling barriers where no address book policies exist can cost people address list visibility, so test what people see in Outlook as part of the matrix.
Decisions
Decision: Where do you test?
Policy application covers the whole tenant, so you can't scope it to a test group. A test tenant is safest for settings; in production, you can define pilot segments from membership of small pilot groups, so only those people are affected until you widen the definition.
Options
- Production only, with real segments
- A test tenant first, then pilot segments in production
Recommended default: A test tenant first, then pilot segments in production
Decision: What's the rollback?
Stopping a policy application isn't instant and doesn't undo policies already applied. Rolling back means setting policies inactive and applying again, at roughly 5,000 accounts an hour, and SharePoint and OneDrive barriers can be suspended separately. Write down the steps, who decides, and how you'd restore team membership from an export taken beforehand.
Options
- Work it out if something goes wrong
- Write and rehearse the rollback before applying
Recommended default: Write and rehearse the rollback before applying
Pilot configuration
Run the test matrix
Test every way people connect: search, one-to-one and group chat, adding to a team, meeting invitations and joining, screen sharing, calls, file sharing and sharing links, Planner assignments, shared channels and guests. Include the known limits: channel meetings that non-members can't join, large meetings where the 1,000-person chat roster fills, and apps that use app-only access to SharePoint, which need a tenant setting to reach sites with barriers. Date each result, because service updates change behaviour and you'll retest. Run each scenario in both directions, since policies work one way, and with an unsegmented person, who should still reach both sides.
Export what will change
Export the membership of every team and Microsoft 365 group on the impact list, and the owners of affected sites. It's your evidence of what changed, your rollback source, and the list of people to brief. Add recurring meetings with large or mixed audiences: anyone who joins once stays on the meeting chat roster for later occurrences, so the 1,000-person limit fills faster than attendance suggests. For large audiences, a town hall is the better fit.
Production configuration
Brief owners, people and the service desk
Tell each affected owner which members will be removed and why, and tell people in segments what they'll no longer see: blocked colleagues disappear from search, suggested contacts and the people picker, and org charts and people cards show an error instead, which people can mistake for someone having left. Give the service desk the troubleshooting steps Microsoft publishes, starting with checking whether a user is covered by a policy, so blocked contact isn't logged as a Teams fault.
Hold the go/no-go
Review the matrix, data quality, rollback plan and briefings with the compliance lead and rule owners. Include the email decision: if mail flow rules are part of the design, they should be tested and ready to enforce with the first barrier. Go means no blocking issue is open and the data is clean; no-go means a dated list of what must change.
Make it enforceable
Policies stay inactive, and pilot segments contain only pilot groups, until the go/no-go is signed. Policy state is the mechanism; the signed checklist is the gate.
Enforced by a mechanism.
Test to sign-off
Prepare data and settingsChange: Inform
Attribute fixed, scoped search on, prerequisites confirmed.
Move on when: Data and settings are ready
Test in the test tenant
Run the matrix against the designed policies.
Move on when: Every row has a result
Pilot segments in productionChange: Explain
Apply barriers for small pilot groups only.
Move on when: Pilot results match the test tenant
Go/no-goChange: Inform
Owners review results, rollback and briefings.
Move on when: No blocking issue is open
Common challenges
If youSkip the wait after scoped directory search
What tends to happenBarriers behave inconsistently in Teams during the first applications.
A better approachTurn scoped search on early and wait at least 24 hours.
If youLeave address books untested
What tends to happenPeople open Outlook and can't find colleagues they're allowed to email.
A better approachTest address list visibility in the matrix.
If youTest chat and nothing else
What tends to happenMeetings, channel meetings or app-only apps fail on day one.
A better approachCover every way people connect, including the documented limits.
If youPlan no rollback
What tends to happenA wrong segment removes people from teams, and nobody knows how to restore them.
A better approachExport membership and write the rollback before applying.
If youSurprise team owners
What tends to happenOwners see members vanish and raise incidents.
A better approachBrief each affected owner with the names and the reason.
Checkpoints
Pilot
- Is the segment attribute complete and correct for everyone in scope?
- Has scoped directory search been on for at least 24 hours?
- Did the matrix include meetings, address lists and app-only apps?
Production
- Is the rollback written and owned?
- Are affected owners and the service desk briefed?
- Is the go/no-go recorded?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Test cases passed | Test matrix | Up |
| In-scope people with a missing or wrong attribute value | Microsoft Entra user export | Down |
| Open blocking issues | Test matrix | Down |
Ready-to-use text
Test matrix (copy into a spreadsheet)
Columns: Scenario | Segments | Expected | Result | Fix | Blocking (Y/N) | Owner. Rows to start with: People search | One-to-one chat | Group chat | Add to a team | Meeting invitation and join | Channel meeting as a non-member | Large meeting near the chat roster limit | Screen share | Call | Share a file and open a sharing link | SharePoint site access by mode | OneDrive sharing | Planner assignment | Shared channel | Guest | Outlook address list | App-only app reaching a site.
Go/no-go checklist
1. Attribute complete and correct. 2. Scoped directory search on for 24 hours or more. 3. No blocking issue open. 4. Membership exported. 5. Rollback written with a decision owner. 6. Owners, people and service desk briefed.
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-16. |