Information Barriers & Insider Risk
Some people in your organisation must NOT communicate with each other. Learn how information barriers enforce ethical walls and how insider risk management detects suspicious behaviour in Teams.
Walls within Teams
Imagine a law firm where the merger team and the litigation team for the SAME client must never talk to each other.
Information barriers (IBs) are invisible walls inside Teams. Traders can’t chat with research analysts. M&A advisors can’t message the team advising the other side of the deal. These walls are legally required in financial services — and IB policies enforce them automatically.
Insider risk management is different — it watches for suspicious patterns. Did an employee about to resign suddenly download 500 files from Teams? Did someone start sending confidential files to a personal email? Insider risk detects these patterns and alerts the compliance team.
Information barriers
How IB works in Teams
IB policies use segments — groups of users defined by attributes (like department, job title, or custom attributes in Entra ID). You then create policies that define which segments are blocked from communicating.
What IBs block in Teams:
- 1:1 and group chats
- Calls (voice and video)
- Adding members to a team or channel
- Meeting invitations (blocked users can’t be invited together)
- User search (blocked users don’t appear in search results)
- File sharing in Teams chats
Setting up information barriers
-
Define segments in Microsoft Purview → Information barriers → Segments
- Example: “Trading Desk” = users where Department = Trading
- Example: “Research Analysts” = users where Department = Research
-
Create IB policies → Policies → Define block/allow rules
- “Trading Desk” Block communication with “Research Analysts”
- This is bidirectional — both sides are blocked
-
Apply the policies → Run the policy application process
- This triggers compliance checks across existing Teams memberships
- Users who violate the policy are automatically removed from teams/chats they shouldn’t be in
Scenario: Nadia's ethical walls at Sterling Financial
Sterling Financial has three trading desks and a research department. Regulators require “ethical walls” (Chinese walls) between them:
Segments:
- Equity Trading (50 users)
- Fixed Income Trading (30 users)
- Research Analysts (20 users)
- Compliance (10 users — must communicate with everyone)
IB Policies:
- Equity Trading BLOCK Research Analysts
- Fixed Income Trading BLOCK Research Analysts
- Compliance ALLOW all segments (compliance is exempt)
What happens:
- A trader tries to add a research analyst to a Teams group chat → blocked
- A research analyst searches for a trader in Teams → trader doesn’t appear in results
- Compliance officer Elena invites both a trader and analyst to separate 1:1 chats → allowed (Elena can talk to both, but they can’t talk to each other)
- An existing team that accidentally has both traders and analysts → IB policy application removes the violating members automatically
IB prerequisites and licensing
- Licence: Microsoft 365 E5, E5 Compliance, or Information Barriers add-on
- Entra ID attributes must be populated (department, job title, etc.) — segments use these
- Scoped directory search must be enabled in Teams
- IB policies take up to 24 hours to fully propagate after application
- IBs work across Teams, SharePoint, and OneDrive — not just Teams in isolation
Insider risk management
What it detects
Insider risk management monitors for patterns like:
| Risk Category | Example Signals | Teams Relevance |
|---|---|---|
| Data theft by departing employee | Mass file downloads, external sharing spike before resignation | Teams files shared to external parties |
| Data leaks | Sensitive files shared to personal accounts, printing spikes | Teams messages containing sensitive info sent to external chats |
| Security policy violations | Accessing restricted sites, using unmanaged devices | Accessing Teams from non-compliant devices (combined with CA signals) |
| Patient data misuse (healthcare) | Accessing records outside of care assignment | Teams discussions about patients outside authorised channels |
Exam tip: Insider risk management does NOT read message content by default. It analyses metadata and patterns — who’s sharing, how much, when. Content-level monitoring requires communication compliance to be enabled separately.
Communication compliance
Communication compliance specifically monitors message content in Teams:
- Offensive language detection — profanity, harassment, threats
- Regulatory compliance — financial advice, insider trading language, HIPAA references
- Sensitive information — similar to DLP but focused on pattern detection over time
- Custom keyword policies — specific terms your organisation defines
- Copilot-generated summaries — flag messages for reviewer without reading full conversations
| Feature | What It Monitors | How It Works | Key Difference |
|---|---|---|---|
| Information barriers | Communication between specific groups | Blocks communication between defined segments | Preventive — stops communication before it happens |
| Insider risk management | User behaviour patterns (metadata) | Machine learning detects anomalous activity patterns | Detective — identifies risky patterns after they start |
| Communication compliance | Message content (text) | Scans messages against policies, flags for reviewer | Detective — monitors content for policy violations |
| DLP | Sensitive information types | Real-time scan and block/warn | Preventive — blocks sensitive data in real-time |
🎬 Video walkthrough
Flashcards
Knowledge Check
Sterling Financial's regulators require that equity traders and research analysts cannot communicate in any Microsoft 365 service. What should Nadia configure?
A compliance officer at Sterling Financial notices that a trader who submitted their resignation last week has been downloading unusually large volumes of files from Teams channels. Which feature would BEST detect this pattern?
Next up: Update Policies & Policy Packages — how to control Teams client updates and bundle policies into ready-made packages for different user groups.