Almanac
Microsoft/teamsMicrosoft 365

Consultant-focused KB for Microsoft Teams: implementation notes, gotchas and configuration decisions beyond the official docs — across chat and collaboration, meetings, webinars and town halls, Teams Phone, PSTN connectivity (Direct Routing, Operator Connect, Calling Plans, Teams Phone Mobile), auto attendants, call queues and contact centre integration, Teams Rooms and devices, apps and extensibility, Copilot in Teams, administration and governance, security and compliance, network and call quality, and licensing — plus cross-cutting decision guides.

teams/10-security-and-compliance/feature-security-teams-information-barriers.md
feature-security-teams-information-barriers.mdv2 · history
CurrentApplies to Microsoft 365 E5Updated 3 weeks agoSource Microsoft Learn ↗

What it does

Purview policies that stop defined groups of people (segments) from finding, chatting, calling or meeting with each other in Teams. The classic case is an investment bank keeping research away from trading, but it turns up in law firms, consultancies and the public sector too.

Key facts

  • IB checks run when someone is added to a team, starts a 1:1 or group chat, is invited to or joins a meeting, starts a screen share, or places a VoIP call. Users blocked by policy are hidden from the people picker.
  • Newly blocked relationships apply to existing conversations: 1:1 chats go read-only, non-compliant users are removed from group chats, and non-compliant users are removed from teams.
  • Teams have an IB mode on the Microsoft 365 group: Open (no IB, default for teams created before IB was turned on), Implicit (default for teams created afterwards; only compatible users can be added) and Owner Moderated (the owner can allow collaboration between incompatible segments).
  • Set the mode with Set-UnifiedGroup -InformationBarrierMode. Microsoft publishes a script for moving existing teams from Open to Implicit.
  • The current version supports up to 5,000 segments and users in more than one segment. Legacy mode is limited to 250 segments with one segment per user and needs extra steps to upgrade.
  • Scoped directory search must be turned on in Teams, and Microsoft says to wait at least a few hours after that before defining IB policies.
  • Admins need the Information Barrier Compliance Management role.
  • Guests are in scope. Federated external users aren't; IB only works inside your tenant and there are no cross-tenant IB groups.
  • Users can't join a scheduled meeting once its chat roster reaches 1,000 people, and non-members can't join channel meetings.
  • IB doesn't apply to Teams-connected SharePoint sites by default; that's a separate switch.
  • Licensing sits in the Microsoft 365 enterprise compliance plans; check the Purview service description for the tenant's position.

When to use / skip

Use it when there's a regulatory or contractual reason two groups mustn't talk: Chinese walls in financial services, conflict checks in a law firm, or a bid team separated from a sister company's delivery team. If the client can point to the regulation or the contract clause, IB is the right tool.

Skip it when the real requirement is "keep this team's content private". That's a private team, a sensitivity label or a private channel, and IB is a heavy way to solve it. It's also a poor fit for very fluid organisations where segments change weekly; every reorganisation becomes a compliance change.

Configuration decisions

  • Segment design: which Entra attribute defines segments (department, a custom extension attribute) and who owns keeping it accurate.
  • Block versus allow policies, and whether any segments need one-way or partial access.
  • Multi-segment membership, which needs the current IB version rather than legacy.
  • Default mode for new teams and whether to bulk-convert existing Open teams to Implicit.
  • Whether any teams need Owner Moderated mode, and who owns those approvals.
  • Whether to extend IB to the SharePoint sites behind teams.
  • How guests are mapped into segments, given they're in scope.

Gotchas

  • Turning on a policy removes people from existing teams and chats. Run the impact analysis before applying, not after the trading floor calls.
  • Existing teams stay Open until you change them. Lots of tenants think IB is working when half their teams are exempt.
  • Segments are only as good as the directory attributes. A blank department field means a user isn't in any segment.
  • Bots, Entra apps and activity-feed APIs aren't supported in the original version, which catches out call recording, contact centre and workflow integrations.
  • Federation bypasses IB. If both sides of a wall chat with the same external party, that's not something IB can stop.
  • Big all-hands meetings over 1,000 roster members stop admitting IB users. Town halls are the usual workaround.

Consultant notes

  • Get compliance to define the segments and sign them off; IT implements, it doesn't decide who's walled.
  • Fix directory data quality first. Run a report of users with no segment-defining attribute before anything else.
  • Pilot with two small segments and confirm people picker, chat, call and meeting behaviour before the real policy.
  • Check every third-party Teams integration against IB support, especially compliance recording and contact centre connectors.
  • Communication compliance is a natural companion for the same clients; IB stops the conversation, comm compliance supervises the ones that are allowed.

Revisit if Microsoft adds cross-tenant IB support or lifts the meeting roster limit

Was this accurate?
Related
Data loss prevention for Teams chat and channel messages10-security-and-complianceExternal Access (Federation) vs Guest Access in Teams09-administration-and-governanceCopilot in Teams chats and channels, and the Channel Agent08-copilot-and-ai-in-teamsPrivate channel vs shared channel vs a separate team13-decision-guidesMeeting Policies, Lobby Bypass and Meeting Options02-meetings-webinars-and-eventsBreakout Rooms in Teams Meetings02-meetings-webinars-and-events