informationBarrierPolicies

Information Barrier Policies. Block communication between defined groups of users. The informationBarrierPolicies entity set lives under /exchange/v1.0/informationBarrierPolicies in the Governance & protection category.

Fact	Value
Path	/exchange/v1.0/informationBarrierPolicies
Category	Governance & protection
Tier	Tier 5, Compliance
Read role	Compliance.IPPS.Read.All (Community)
Write role	Compliance.IPPS.ReadWrite.All (Enterprise)
Backing cmdlets	Get-ExoInformationBarrierPolicy, New-InformationBarrierPolicy, Set-InformationBarrierPolicy, Remove-InformationBarrierPolicy, Start-InformationBarrierPoliciesApplication, Stop-InformationBarrierPoliciesApplication

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/informationBarrierPolicies	List informationBarrierPolicies entries.	Compliance.IPPS.Read	Community
POST	/exchange/v1.0/informationBarrierPolicies	Create a new informationBarrierPolicies entry via New-InformationBarrierPolicy (IPPS pool). Body keys map 1:1 to cmdlet params (camelCased). Required: name + assignedSegment. Then ONE of (segmentAllowedFilter | segmentsAllowed | segmentsBlocked) - parameter-set discriminator. Returns 201 + Location + the freshly-fetched policy.	Compliance.IPPS.ReadWrite	Enterprise
POST	/exchange/v1.0/informationBarrierPolicies/applyAll	POST /informationBarrierPolicies/applyAll - Start-InformationBarrierPoliciesApplication. Activates all defined policies tenant-wide. Asynchronous - large tenants may take hours.	Compliance.IPPS.ReadWrite	Enterprise
GET	/exchange/v1.0/informationBarrierPolicies/{key}	Get a single informationBarrierPolicies entry by Identity.	Compliance.IPPS.Read	Community
PATCH	/exchange/v1.0/informationBarrierPolicies/{key}	Partial update of the informationBarrierPolicies at /{key}. Body keys map 1:1 to Set-InformationBarrierPolicy params. The assignedSegment is immutable post-creation. Use the 3 segment-list params (segmentAllowedFilter / segmentsAllowed / segmentsBlocked) to adjust the policy’s allowed/blocked rules. Returns 200 + the post-Set policy.	Compliance.IPPS.ReadWrite	Enterprise
DELETE	/exchange/v1.0/informationBarrierPolicies/{key}	Remove the informationBarrierPolicies at /{key}. Returns 204.	Compliance.IPPS.ReadWrite	Enterprise
POST	/exchange/v1.0/informationBarrierPolicies/{key}/stopApplication	POST /informationBarrierPolicies/{key}/stopApplication - Stop-InformationBarrierPoliciesApplication. Halts an in-flight policy application identified by Identity (typically the ApplicationId returned from a recent applyAll).	Compliance.IPPS.ReadWrite	Enterprise

GET /exchange/v1.0/informationBarrierPolicies

List informationBarrierPolicies entries.

Backing cmdlet: Get-ExoInformationBarrierPolicy. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
showFriendlyValues	query	bool (switch)		Show enum-typed and segment-id fields as human-readable strings (slower).

List EXO information barrier policies

Lists Exchange Online information barrier policies via Get-ExoInformationBarrierPolicy. Each policy assigns a sender segment and a set of recipient segments to allow or block. Tier 5 IPPS - backed by Compliance.IPPS.Read.All; routes through the EXO pool. The IPPS-side sibling Get-InformationBarrierPolicy exists with a different SYNTAX (-ExoPolicyId) and is intentionally not exposed.

GET /exchange/v1.0/informationBarrierPolicies HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#informationBarrierPolicies",
  "value": [
    {
      "Id": "policy-finance-blocks-research-guid",
      "Name": "Finance blocks Research",
      "Identity": "policy-finance-blocks-research-guid",
      "Active": true,
      "State": "Active",
      "AssignedSegment": "Finance",
      "SegmentsBlocked": [
        "Research"
      ],
      "SegmentsAllowed": []
    }
  ]
}

Related: GET /exchange/v1.0/informationBarrierPolicies/{key}, GET /exchange/v1.0/informationBarrierSegments, GET /exchange/v1.0/informationBarrierRelationships

POST /exchange/v1.0/informationBarrierPolicies

Create a new informationBarrierPolicies entry via New-InformationBarrierPolicy (IPPS pool). Body keys map 1:1 to cmdlet params (camelCased). Required: name + assignedSegment. Then ONE of (segmentAllowedFilter | segmentsAllowed | segmentsBlocked) - parameter-set discriminator. Returns 201 + Location + the freshly-fetched policy.

Information barriers enforce communication policies between organizational segments (Finance vs Research, etc.). Each policy applies TO an assignedSegment and defines who that segment CAN (segmentsAllowed, segmentAllowedFilter) or CANNOT (segmentsBlocked) communicate with. After creating policies + segments, run the bound action POST /informationBarrierPolicies/applyAll (Start-InformationBarrierPoliciesApplication) to activate them across the tenant. This is asynchronous and can take hours on large tenants.IPPS-side - controller passes omitConfirm: true. Pass ?dryRun=true to map to -WhatIf.

Backing cmdlet: New-InformationBarrierPolicy. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
assignedSegment	body		yes
name	body		yes
comment	body
moderationAllowed	body
segmentAllowedFilter	body
segmentsAllowed	body
segmentsBlocked	body
state	body
dryRun	query	bool (switch)

Create rejected - missing required field

New-InformationBarrierPolicy requires both name and assignedSegment. Omitting assignedSegment fails body validation before the cmdlet is invoked, returning the canonical 400 envelope.

POST /exchange/v1.0/informationBarrierPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-informationBarrierPolicies",
  "segmentsBlocked": [
    "Sales"
  ]
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The 'assignedSegment' field is required.",
    "target": "assignedSegment"
  },
  "correlationId": "0HN7K2Q8V3R1P:00000004"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

Create an information barrier policy

Creates a new information barrier policy via New-InformationBarrierPolicy (IPPS pool). Required fields are name and assignedSegment, plus exactly one of segmentAllowedFilter / segmentsAllowed / segmentsBlocked (parameter-set discriminator). The policy is inactive until POST /informationBarrierPolicies/applyAll is called.

POST /exchange/v1.0/informationBarrierPolicies HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-informationBarrierPolicies",
  "assignedSegment": "Finance",
  "segmentsBlocked": [
    "Sales",
    "Marketing"
  ],
  "comment": "Block Finance from communicating with Sales and Marketing.",
  "moderationAllowed": false,
  "state": "Active"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/informationBarrierPolicies/exonaut-sample-informationBarrierPolicies

{
  "Id": "exonaut-sample-informationBarrierPolicies",
  "Identity": "exonaut-sample-informationBarrierPolicies",
  "Name": "exonaut-sample-informationBarrierPolicies",
  "AssignedSegment": "Finance",
  "SegmentsBlocked": [
    "Sales",
    "Marketing"
  ],
  "Comment": "Block Finance from communicating with Sales and Marketing.",
  "ModerationAllowed": false,
  "State": "Active"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

POST /exchange/v1.0/informationBarrierPolicies/applyAll

POST /informationBarrierPolicies/applyAll - Start-InformationBarrierPoliciesApplication. Activates all defined policies tenant-wide. Asynchronous - large tenants may take hours.

Per Wiki, this cmdlet accepts an optional -Identity param to scope to a single policy, but the common case is “apply all currently defined policies” - exposed here as the no-key variant. The cleanupGroupSegmentLink switch removes orphan segment-link records left over from earlier policy revisions; useful when re-running after a Set-* on segment composition.

Backing cmdlet: Start-InformationBarrierPoliciesApplication. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
cleanupGroupSegmentLink	query	bool (switch)
dryRun	query	bool (switch)

Apply all information barrier policies

Sub-resource of informationBarrierPolicies at GET /informationBarrierPolicies - activates all defined information barrier policies tenant-wide via Start-InformationBarrierPoliciesApplication (IPPS pool). The operation is asynchronous and may take hours on large tenants. Returns 204.

POST /exchange/v1.0/informationBarrierPolicies/applyAll HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

GET /exchange/v1.0/informationBarrierPolicies/{key}

Get a single informationBarrierPolicies entry by Identity.

Backing cmdlet: Get-ExoInformationBarrierPolicy. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
showFriendlyValues	query	bool (switch)		Show enum-typed and segment-id fields as human-readable strings.

PATCH /exchange/v1.0/informationBarrierPolicies/{key}

Partial update of the informationBarrierPolicies at /{key}. Body keys map 1:1 to Set-InformationBarrierPolicy params. The assignedSegment is immutable post-creation. Use the 3 segment-list params (segmentAllowedFilter / segmentsAllowed / segmentsBlocked) to adjust the policy’s allowed/blocked rules. Returns 200 + the post-Set policy.

Changing a policy’s segment-list rules does NOT automatically re-apply the change tenant-wide; call POST /informationBarrierPolicies/applyAll after PATCH to push the updated rules into effect. IPPS-side - omitConfirm: true.

Backing cmdlet: Set-InformationBarrierPolicy. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
comment	body
moderationAllowed	body
segmentAllowedFilter	body
segmentsAllowed	body
segmentsBlocked	body
state	body
dryRun	query	bool (switch)

Update an information barrier policy

Partially updates the information barrier policy at /informationBarrierPolicies/{key} via Set-InformationBarrierPolicy (IPPS pool). The assignedSegment is immutable; use segmentAllowedFilter / segmentsAllowed / segmentsBlocked to adjust the policy’s rules. Changes are inactive until POST /informationBarrierPolicies/applyAll is called.

PATCH /exchange/v1.0/informationBarrierPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "segmentsBlocked": [
    "Sales",
    "Marketing",
    "Legal"
  ],
  "comment": "Extend block list to include Legal.",
  "state": "Active"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-informationBarrierPolicies",
  "Identity": "exonaut-sample-informationBarrierPolicies",
  "Name": "exonaut-sample-informationBarrierPolicies",
  "AssignedSegment": "Finance",
  "SegmentsBlocked": [
    "Sales",
    "Marketing",
    "Legal"
  ],
  "Comment": "Extend block list to include Legal.",
  "State": "Active"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

DELETE /exchange/v1.0/informationBarrierPolicies/{key}

Remove the informationBarrierPolicies at /{key}. Returns 204.

Removing a policy doesn’t undo segment communications it previously blocked/allowed - until POST /informationBarrierPolicies/applyAll runs again, the prior policy’s effects persist. IPPS-side - uses -ForceDeletion internally (not -Force); omitConfirm: true.

Backing cmdlet: Remove-InformationBarrierPolicy. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Delete an information barrier policy

Removes the information barrier policy at /informationBarrierPolicies/{key} via Remove-InformationBarrierPolicy (IPPS pool). The removal does not take effect tenant-wide until POST /informationBarrierPolicies/applyAll is called.

DELETE /exchange/v1.0/informationBarrierPolicies/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

POST /exchange/v1.0/informationBarrierPolicies/{key}/stopApplication

POST /informationBarrierPolicies/{key}/stopApplication - Stop-InformationBarrierPoliciesApplication. Halts an in-flight policy application identified by Identity (typically the ApplicationId returned from a recent applyAll).

Backing cmdlet: Stop-InformationBarrierPoliciesApplication. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
dryRun	query	bool (switch)

Stop an in-flight policy application

Sub-resource of informationBarrierPolicies at GET /informationBarrierPolicies/{key} - halts an in-flight information barrier policy application identified by Identity (typically the ApplicationId returned from a recent applyAll) via Stop-InformationBarrierPoliciesApplication (IPPS pool). Returns 204.

POST /exchange/v1.0/informationBarrierPolicies/{key}/stopApplication HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Related: GET /exchange/v1.0/informationBarrierPolicies

?dryRun=true previews of any write stay on Community.