Organisations relying on Microsoft 365 Information Barriers to enforce an ethical wall should not assume the controls cover email. Testing has found the feature blocks Teams, OneDrive and SharePoint, but does not prevent email communication in Exchange Online.
The finding comes from MSX Labs, the innovation and testing hub within FTI Technology. It was published in FTI Technology Microsoft 365 Client Update Volume 8, the firm's client newsletter for legal, compliance and technology leaders.
Information Barriers are designed to prevent communication and collaboration between defined groups of users inside Microsoft 365. Organisations commonly deploy them to address regulatory requirements, conflicts of interest, insider risk concerns and ethical wall obligations.
MSX Labs evaluated the functionality across key Microsoft 365 workloads to establish how the controls operate in practice. The testing confirmed that Information Barriers effectively restricted real-time communication within Microsoft Teams.
Sharing through OneDrive was also blocked. Access and sharing within SharePoint sites configured in Explicit Mode was restricted as well.
Users in restricted segments were unable to communicate through Teams or share content across protected boundaries once policies had propagated. FTI recorded a pass result for each of those three workloads.
Exchange was the exception. FTI recorded that email was not blocked by Information Barriers, and marked the workload as requiring separate controls.
The firm noted the behaviour aligns with Microsoft's documented design. Organisations seeking to restrict email between user groups must implement Exchange controls, such as mail flow rules or comparable compensating controls.
Where the gap bites
The practical consequence is a compliance gap in exactly the scenarios where ethical walls matter most. FTI said Information Barriers are often viewed as a comprehensive ethical wall solution, particularly in highly regulated industries.
The examples it cites are regulatory investigations, mergers and acquisitions, insider trading prevention programs, conflicts-of-interest management and legal ethical wall requirements. Each of those can require complete separation between defined populations.
An organisation may successfully block collaboration through Teams, SharePoint and OneDrive while email communications between restricted populations remain possible. FTI described this as a compliance gap where policies require complete separation.
Its guidance is that an ethical wall strategy should be designed and validated across the full Microsoft 365 environment. It should not be assumed from the successful deployment of a single feature.
Before relying on Information Barriers for compliance-sensitive scenarios, the firm recommends validating four things. Those are Teams communication restrictions, SharePoint access controls, OneDrive sharing restrictions, and Exchange email controls through separate testing.
Where email separation is required, FTI recommends a layered control model. That combines Information Barriers with appropriately configured and independently tested Exchange controls.
The testing also documented how the controls behave when configured. Screenshots in the newsletter show Teams communication blocked after policy propagation, and a SharePoint site configured in Explicit Mode enforcing segment-based access restrictions.
Explicit mode also disables the copy link button and blocks segment-to-segment sharing. The newsletter notes that Information Barriers restrict collaboration but do not necessarily restrict every communication channel.
Volume 8 covers two further subjects alongside the Information Barriers work. One is early case assessment using Microsoft Purview Review Sets, and the other is Copilot adoption and the AI value journey.
On Review Sets, FTI described work with an in-house legal team that needed to evaluate a single custodian's data quickly. Traditional approaches would have required export, processing and loading into a review platform first.
Instead the team performed early case assessment directly within Microsoft 365. FTI developed and executed targeted search strategies, moved responsive content into Review Sets, configured reviewer permissions for secure access and built customised coding layouts.
The outcome was earlier review of potentially responsive content and earlier identification of key facts and risks. Downstream processing costs fell because export was limited to the most relevant data.
FTI positions Review Sets as a middle ground between simple searches and full-scale review workflows. It notes the approach is not appropriate for every matter, but is practical where legal teams need rapid visibility into a targeted population.