Microsoft Purview Information Barriers
Compliance-enforced ethical wall between Finance and HR, blocking Teams communication and SharePoint/OneDrive collaboration in both directions, independently verified via PowerShell and live Teams enforcement testing.
Difficulty
Advanced
Environment
Microsoft 365 / Purview
Deployment
Home Lab
Est. Implementation
1 day
Executive Summary
This project implemented and validated Microsoft Purview Information Barriers to create a compliance-enforced ethical wall between the Finance and HR departments in a Microsoft 365 tenant, blocking Teams communication and SharePoint/OneDrive collaboration in both directions.
Two attribute-based segments (Finance Department, HR Department) were created from the Department directory attribute, and a pair of directional Information Barrier policies (Finance-HR Block Policy, HR-Finance Block Policy) was configured as Blocked and Active, then compiled tenant-wide by the Purview policy application engine.
Enforcement was independently verified at three layers: the Purview policy application job reaching Completed/100%, Exchange Online PowerShell confirming Communication1To2: False and Communication2To1: False between a Finance-segment and an HR-segment test user, and a live Microsoft Teams chat attempt between the two users returning "Failed to send."
Business Problem
Without a technical control, any two Microsoft 365 users can freely chat, call and share files in Teams and SharePoint/OneDrive regardless of department or role, and relying on policy and training alone does not prevent accidental or intentional information leakage between segregated business units such as Finance and HR.
Regulated organizations in financial services, healthcare, legal and public sector are often required to prevent certain groups of employees from communicating to avoid conflicts of interest, insider trading, or inappropriate access to sensitive personal or financial data, and need demonstrable, auditable technical enforcement rather than a policy document alone.
Business Risks
- Unrestricted Teams chat/calls and SharePoint/OneDrive collaboration between segregated departments
- Conflict-of-interest or insider-trading exposure between Finance and HR
- Inappropriate access to sensitive compensation, workforce action, or financial reporting data
- No auditable, PowerShell-queryable evidence of segregation for compliance reporting
Compliance Concerns
- Conflict-of-interest and insider-trading prevention obligations
- Auditable segregation-of-duties evidence via Get-EXOInformationBarrierRelationship
Solution Overview
Created two attribute-based Information Barrier segments — Finance Department and HR Department — filtered on the Department directory attribute (department -eq 'Finance').
Configured two directional Information Barrier policies (Finance-HR Block Policy and HR-Finance Block Policy) with Communication and collaboration set to Blocked and Policy status set to Active, then ran the Purview policy application engine to compile the relationship tenant-wide.
Independently verified the enforced relationship using Exchange Online PowerShell (Get-EXOInformationBarrierRelationship) and a live Microsoft Teams chat attempt between a Finance-segment and an HR-segment test user.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Purview Information Barriers
Segments, policies and policy application engine
Microsoft Purview compliance portal
Segment and policy configuration workspace
Exchange Online PowerShell
ExchangeOnlineManagement module — relationship verification cmdlets
Department directory attribute
Recipient attribute used as the segment filter condition
Microsoft Teams
1:1 chat enforcement surface — validated live
SharePoint Online / OneDrive for Business
Collaboration surfaces governed by the same IB policy
Lab Environment
- Segments
- Finance Department, HR Department
- Segment filter
- department -eq 'Finance'
- Policies
- Finance-HR Block Policy, HR-Finance Block Policy
- Policy application duration
- ~4.5 minutes (ApplyInProgress → Completed)
- Test users
- testuser1 (Finance), testuser2 (HR)
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Define the two organizational segments used to group users by attribute.
- Create the Finance Department segment with filter Department Equal Finance
- Confirm the wizard compiles the filter to department -eq 'Finance'
- Create the HR Department segment using the equivalent Department-based filter
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Connect to Exchange Online and verify the Information Barrier relationship
# Connect to Exchange Online (required for all IB cmdlets)
Connect-ExchangeOnline -UserPrincipalName "admin@securem365lsb.onmicrosoft.com"
# Verify the computed relationship between two specific recipients
.\Verify-InformationBarrier.ps1 -RecipientId1 "testuser1@securem365lsb.onmicrosoft.com" -RecipientId2 "testuser2@securem365lsb.onmicrosoft.com"
# View all configured segments and policies
Get-OrganizationSegment
Get-InformationBarrierPolicy
# Manually trigger policy application and check job status
Start-InformationBarrierPoliciesApplication
Get-InformationBarrierPoliciesApplicationStatusConfiguration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Phase 1
Phase 2
Phase 3
Phase 4
Phase 5
Validation
Segments Created Correctly
Finance Department and HR Department both present in the Purview Segments page.
Policy Configuration Accurate
Wizard summary confirms Blocked communication, HR Department as the blocked segment, Active status, moderation disabled.
Both Directional Policies Active
Policies list confirms 2 Active policies — Finance-HR Block Policy and HR-Finance Block Policy.
Policy Application Completed
Policy application job reached Completed at 100% (~4.5 minutes from start).
Segment Resolution Correct
Get-EXOInformationBarrierRelationship correctly maps testuser1 to Finance Department and testuser2 to HR Department.
Bidirectional Block Enforced
PowerShell confirms Communication1To2: False and Communication2To1: False; re-verified as stable on a second run.
Real-World Teams Enforcement
A live chat message between the two segmented test users returned 'Failed to send' in the Teams client.
Challenges
Asynchronous policy application
The policy application job took roughly 4–5 minutes to move from ApplyInProgress to Completed; validating enforcement before completion would have produced a false negative.
Incomplete evidence for the HR segment wizard
The HR Department segment and HR-Finance Block Policy creation screens were not captured, so their exact filter expression is assumed by naming convention rather than visually confirmed.
Lessons Learned
- Information Barriers are attribute-driven — the accuracy of the underlying directory attribute (Department) directly determines segment and policy accuracy.
- Bidirectional segregation requires two policies, not one — a single policy only blocks the assigned segment's outbound communication toward the blocked segment.
- Policy application is asynchronous and must be confirmed as Completed before relying on the control or presenting it as enforced.
- PowerShell verification and live-client testing are complementary — the portal and PowerShell confirm configuration, while a real chat attempt confirms enforcement.
- Information Barriers block new communication; they do not retroactively delete or hide prior chat history.
Business Impact
3 (Portal, PowerShell, Teams)
Enforcement Layers Validated
Communication False both ways
Bidirectional Block Confirmed
~4.5 minutes
Policy Application Time
2 (Finance, HR)
Segments Configured
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
lokeshm-it/Microsoft-Information-Barriers
PublicMicrosoft Purview Information Barriers enforcing a compliance-driven ethical wall between Finance and HR, validated via PowerShell and live Teams enforcement testing.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon