Information Barriers & Insider Risk | Guided by A Guide to Cloud

Walls within Teams

Simple explanation

Imagine a law firm where the merger team and the litigation team for the SAME client must never talk to each other.

Information barriers (IBs) are invisible walls inside Teams. Traders can’t chat with research analysts. M&A advisors can’t message the team advising the other side of the deal. These walls are legally required in financial services — and IB policies enforce them automatically.

Insider risk management is different — it watches for suspicious patterns. Did an employee about to resign suddenly download 500 files from Teams? Did someone start sending confidential files to a personal email? Insider risk detects these patterns and alerts the compliance team.

Information barriers

How IB works in Teams

IB policies use segments — groups of users defined by attributes (like department, job title, or custom attributes in Entra ID). You then create policies that define which segments are blocked from communicating.

What IBs block in Teams:

1:1 and group chats
Calls (voice and video)
Adding members to a team or channel
Meeting invitations (blocked users can’t be invited together)
User search (blocked users don’t appear in search results)
File sharing in Teams chats

Setting up information barriers

Define segments in Microsoft Purview → Information barriers → Segments
- Example: “Trading Desk” = users where Department = Trading
- Example: “Research Analysts” = users where Department = Research
Create IB policies → Policies → Define block/allow rules
- “Trading Desk” Block communication with “Research Analysts”
- This is bidirectional — both sides are blocked
Apply the policies → Run the policy application process
- This triggers compliance checks across existing Teams memberships
- Users who violate the policy are automatically removed from teams/chats they shouldn’t be in

Scenario: Nadia's ethical walls at Sterling Financial

Sterling Financial has three trading desks and a research department. Regulators require “ethical walls” (Chinese walls) between them:

Segments:

Equity Trading (50 users)
Fixed Income Trading (30 users)
Research Analysts (20 users)
Compliance (10 users — must communicate with everyone)

IB Policies:

Equity Trading BLOCK Research Analysts
Fixed Income Trading BLOCK Research Analysts
Compliance ALLOW all segments (compliance is exempt)

What happens:

A trader tries to add a research analyst to a Teams group chat → blocked
A research analyst searches for a trader in Teams → trader doesn’t appear in results
Compliance officer Elena invites both a trader and analyst to separate 1:1 chats → allowed (Elena can talk to both, but they can’t talk to each other)
An existing team that accidentally has both traders and analysts → IB policy application removes the violating members automatically

IB prerequisites and licensing

Licence: Microsoft 365 E5, E5 Compliance, or Information Barriers add-on
Entra ID attributes must be populated (department, job title, etc.) — segments use these
Scoped directory search must be enabled in Teams
IB policies take up to 24 hours to fully propagate after application
IBs work across Teams, SharePoint, and OneDrive — not just Teams in isolation

Insider risk management

What it detects

Insider risk management monitors for patterns like:

Risk Category	Example Signals	Teams Relevance
Data theft by departing employee	Mass file downloads, external sharing spike before resignation	Teams files shared to external parties
Data leaks	Sensitive files shared to personal accounts, printing spikes	Teams messages containing sensitive info sent to external chats
Security policy violations	Accessing restricted sites, using unmanaged devices	Accessing Teams from non-compliant devices (combined with CA signals)
Patient data misuse (healthcare)	Accessing records outside of care assignment	Teams discussions about patients outside authorised channels

Exam tip: Insider risk management does NOT read message content by default. It analyses metadata and patterns — who’s sharing, how much, when. Content-level monitoring requires communication compliance to be enabled separately.

Communication compliance

Communication compliance specifically monitors message content in Teams:

Offensive language detection — profanity, harassment, threats
Regulatory compliance — financial advice, insider trading language, HIPAA references
Sensitive information — similar to DLP but focused on pattern detection over time
Custom keyword policies — specific terms your organisation defines
Copilot-generated summaries — flag messages for reviewer without reading full conversations

Teams compliance features comparison
Feature	What It Monitors	How It Works	Key Difference
Information barriers	Communication between specific groups	Blocks communication between defined segments	Preventive — stops communication before it happens
Insider risk management	User behaviour patterns (metadata)	Machine learning detects anomalous activity patterns	Detective — identifies risky patterns after they start
Communication compliance	Message content (text)	Scans messages against policies, flags for reviewer	Detective — monitors content for policy violations
DLP	Sensitive information types	Real-time scan and block/warn	Preventive — blocks sensitive data in real-time

🎬 Video walkthrough

🎬 Video coming soon

Information Barriers & Insider Risk — MS-700 Module 5

~10 min

Flashcards

Question

What do information barriers block in Teams?

Click or press Enter to reveal answer

Answer

Chats, calls, meeting invitations, team/channel membership, user search, and file sharing between defined segments. Blocked users can't even find each other in Teams search.

Click to flip back

Question

What's the difference between information barriers and DLP?

Click or press Enter to reveal answer

Answer

IBs are preventive walls between groups — they block ALL communication between segments regardless of content. DLP scans message content for specific sensitive information types and blocks/warns based on what's shared, not who's sharing.

Click to flip back

Question

Does insider risk management read Teams message content?

Click or press Enter to reveal answer

Answer

No — by default it analyses metadata and behaviour patterns (who, how much, when). Content-level message monitoring requires communication compliance to be enabled separately.

Click to flip back

Knowledge Check

Sterling Financial's regulators require that equity traders and research analysts cannot communicate in any Microsoft 365 service. What should Nadia configure?

Knowledge Check

A compliance officer at Sterling Financial notices that a trader who submitted their resignation last week has been downloading unusually large volumes of files from Teams channels. Which feature would BEST detect this pattern?

Next up: Update Policies & Policy Packages — how to control Teams client updates and bundle policies into ready-made packages for different user groups.