When your organization uses information barriers in Teams, a chat between an internal user and a guest can still go through even though the policy should block it. This happens because guest users are not subject to the same information barrier policies as internal users. In this article, you will learn why the barrier fails for guest conversations and how to apply the correct policy configuration to close the gap.
The root cause is that information barrier policies apply only to users in your organization, not to external or guest accounts. When a guest is added to a chat, Teams treats the conversation as external, and the barrier engine does not evaluate the guest’s identity. You will also see the steps to verify policy assignments, check the effective policy for a guest, and use a custom policy to block the chat entirely.
By the end, you will know how to adjust your information barrier setup and test the chat to confirm the block works. You will also learn the limitations of the current feature and what to do if the barrier still does not apply.
Key Takeaways: Fixing Information Barrier Gaps for Guest Chats
- Teams admin center > Information barriers > Policies: Shows the list of active barrier policies and which segments they apply to.
- PowerShell cmdlet Get-InformationBarrierPolicy: Displays the exact policy assignments for a user or a segment.
- Information barrier policy mode: Set to Block to prevent communication between specific segments, including guest segments.
Why Information Barriers Do Not Block Guest Conversations
Information barriers in Teams are designed to prevent communication between internal segments of your organization, such as departments or compliance groups. The barrier engine evaluates each message against the policy that applies to the sender and the recipient. For internal users, this evaluation happens automatically before the message is delivered.
Guest users are not part of your Azure AD tenant. They are external identities that you invite into your organization. Because they are not internal, the information barrier engine does not load a policy for them. As a result, a chat between an internal user and a guest bypasses the barrier check entirely. The chat is treated as an external conversation, and the barrier policies that apply to your internal users are not consulted.
The technical root cause is that information barrier policies are scoped to Azure AD user objects. Guest accounts have a separate object type, and the barrier engine does not assign a segment to them unless you explicitly create a segment that includes guests. By default, no segment exists for guests, so no policy applies.
How the Barrier Engine Evaluates a Guest Chat
When an internal user starts a chat with a guest, Teams checks the guest’s user type. If the user type is Guest, the chat is routed to the external messaging pipeline. That pipeline does not run the information barrier policy engine. The only way to force the engine to evaluate the conversation is to assign a segment to the guest account, which is not a supported operation in the current Teams admin center.
Steps to Verify and Fix the Information Barrier for Guest Chats
Follow these steps to confirm the policy gap and apply a workaround that blocks the chat.
- Check the current information barrier policy assignments
Open the Teams admin center at admin.teams.microsoft.com. Go to Information barriers > Policies. Look for the policy that should block the chat between your internal segment and the guest segment. Note the policy name and its mode. If the mode is Allow, change it to Block. - Verify the internal user’s segment
In the Teams admin center, go to Users > Manage users. Select the internal user who is trying to chat with the guest. Under the Policies tab, find the Information barrier policy assignment. Confirm that the user belongs to the segment that is supposed to be blocked from communicating with guests. - Check if a guest segment exists
Go to Information barriers > Segments. If no segment includes guest users, create one. To create a segment, click Add segment. Give it a name like “Guests”. Under User groups, add a group that contains all guest users in your tenant. You can use the built-in All Guests group if it exists, or create a dynamic group based on the user type attribute. - Apply the barrier policy to the guest segment
After creating the guest segment, go back to Information barriers > Policies. Edit the policy that should block the chat. Under Segments, add the guest segment as a blocked segment. Save the policy. This tells the barrier engine to evaluate conversations between the internal segment and the guest segment. - Test the chat from a guest account
Sign in to Teams with the internal user account. Start a new chat with the guest user. If the policy is working, the chat should fail to send. You will see an error message that the message cannot be sent due to an information barrier policy. - Use PowerShell to force a policy refresh
Open PowerShell and connect to the Security & Compliance Center. Run the command Start-InformationBarrierPoliciesApplication. This forces the barrier engine to re-evaluate all policies and apply the new segment assignment. Wait for the application to complete before testing again.
If the Chat Still Goes Through
If the chat still goes through after you added the guest segment, the issue is that Teams does not support information barrier policies for guest users in the current version. The barrier engine only evaluates internal user objects. A segment that includes guests is ignored during the chat evaluation. In this case, the only reliable fix is to block guest access to Teams entirely.
If Teams Still Allows Guest Chats After the Fix
Guest access is not controlled by information barriers
Information barriers are not the same as external access settings. To block all guest chat, go to Teams admin center > Users > Guest access. Set Allow guest access in Microsoft Teams to Off. This prevents guests from joining any chat or channel. This is a blunt approach, but it is the only guaranteed way to stop guest conversations.
Guest appears as an external user in the chat
If the guest is actually an external user from another organization that uses Teams, the conversation is treated as a federated chat. Information barriers do not apply to federated conversations either. To block federated chats, go to Teams admin center > External access. Remove the domain from the allowed list, or block all external access.
Policy application delay
After you change a policy, it can take up to 24 hours for the change to propagate. Run the Start-InformationBarrierPoliciesApplication cmdlet to speed up the process. Check the policy status in the admin center to confirm it is Active.
Information Barrier Policy vs Guest Access Settings: Key Differences
| Item | Information Barrier Policy | Guest Access Setting |
|---|---|---|
| Scope | Applies to internal Azure AD user objects | Applies to all guest users in the tenant |
| Granularity | Can target specific segments and users | Is a global on/off switch for all guests |
| Evaluation | Runs before message delivery | Determines whether a guest can sign in and chat at all |
| Support for guest users | Not supported in the current Teams version | Fully supported and reliable |
If you need to block a specific guest conversation, you must rely on guest access settings or external access settings. Information barriers alone cannot guarantee the block.
Now you know the exact reason why information barriers do not block guest chats and the workaround that actually works. Start by verifying your current policy assignments and then turn off guest access if you need a hard block. For a more precise control, you can also use Teams admin center > External access to block specific domains. Remember that information barrier policies are not designed for guest identities, so do not rely on them for external communication.