Advanced ⏱ 120 min 📋 12 Steps

Deploy Records Management, Information Barriers & Compliance Manager

Implement legally defensible records management with regulatory records and event-based retention, enforce Chinese walls between conflicting business divisions with Information Barriers, and assess your compliance posture against 300+ regulatory templates with Compliance Manager.

📋 Overview

About This Lab

This lab covers three advanced Microsoft Purview solutions that enforce regulatory obligations across your organisation. Records Management lets you declare, retain, and dispose of business records with legally defensible processes. including immutable regulatory records that cannot be modified or deleted before their retention period expires. Information Barriers prevent communication and collaboration between conflicting groups, such as investment banking and equity research, enforcing ethical walls required by financial regulations. Compliance Manager helps you assess and improve your compliance posture with over 300 built-in regulatory assessment templates covering frameworks like ISO 27001, SOC 2, GDPR, HIPAA, and more.

🏢 Enterprise Use Case

A global investment bank with 25,000 employees needs to comply with multiple regulatory frameworks simultaneously. SEC Rule 17a-4, MiFID II, and GDPR. They must maintain Chinese walls between their Investment Banking and Equity Research divisions to prevent insider trading. Trading communications and deal records must be declared as regulatory records that cannot be modified or deleted for seven years. The Chief Compliance Officer must demonstrate to auditors that the organisation’s compliance posture exceeds an 85% compliance score across all applicable regulatory frameworks, with clear evidence of improvement actions assigned and completed.

🎯 What You Will Learn

  1. Navigate the Records Management solution and review the file plan
  2. Create file plan descriptors and record retention labels
  3. Declare regulatory records with immutability enforcement
  4. Configure event-based retention triggered by business events
  5. Set up multi-stage disposition review and approval workflows
  6. Understand Information Barrier prerequisites and segment architecture
  7. Create user segments based on Azure AD attributes
  8. Build and apply Information Barrier policies between conflicting divisions
  9. Test and validate barrier enforcement across Teams, SharePoint, and OneDrive
  10. Navigate the Compliance Manager dashboard and understand compliance scores
  11. Run regulatory assessments and assign improvement actions
  12. Generate audit-ready compliance reports and plan ongoing operations

🔑 Why This Matters

Regulatory penalties for non-compliance can be devastating. GDPR fines reach up to €20 million or 4% of global revenue, and SEC enforcement actions regularly exceed $100 million. Without records management, organisations cannot prove legally defensible retention or disposal of business records, leaving them exposed during litigation and regulatory investigations. Information Barriers are legally mandated in financial services to prevent conflicts of interest; failure to enforce ethical walls can result in criminal charges for insider trading. Compliance Manager provides the continuous assessment framework that auditors and regulators expect, transforming compliance from a point-in-time exercise into an ongoing, measurable programme.

⚙️ Prerequisites

  • Completed Labs 01–05. sensitivity labels, DLP, Insider Risk, eDiscovery, and Communication Compliance deployed
  • Records Management Administrator role. in the Microsoft Purview compliance portal
  • Compliance Administrator role. required for Information Barriers and Compliance Manager
  • Microsoft 365 E5 license. or E5 Compliance add-on (required for regulatory records, Information Barriers, and premium Compliance Manager assessments)
  • Azure AD attributes populated. Department attribute set for all users (required for Information Barrier segments)
  • Exchange Online PowerShell and Security & Compliance PowerShell modules. for policy automation
  • Test user accounts in at least two departments. e.g., Investment Banking and Equity Research
💡 Pro Tip: Information Barriers require directory scoping to be enabled before policies take effect. Plan your Azure AD attribute population carefully. segments depend on accurate, consistent department and role attributes across all user accounts.

Step 1 · Navigate to Records Management

Begin by exploring the Records Management solution in the Microsoft Purview compliance portal. Review the file plan to understand how retention labels and record declarations are organised.

Portal Instructions

  1. Navigate to compliance.microsoft.com > Records management
  2. Review the Overview dashboard. note existing retention labels, policies, and disposition items
  3. Click File plan. this is your central repository for all retention labels with file plan descriptors
  4. Review existing labels: note their retention period, action at end of retention, and whether they mark items as records
  5. Click Events. review any existing retention events that trigger time-based retention
  6. Click Disposition. review pending disposition reviews for records whose retention has expired

PowerShell: Review Existing Labels

# Connect to Security & Compliance PowerShell
# WHY: Required session for all Records Management and retention label cmdlets
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# List all existing retention labels in the tenant
# WHAT: Shows every retention label with its retention settings and record status
# OUTPUT: Name, RetentionDuration (days), RetentionAction (Keep/Delete),
#         IsRecordLabel (True/False), Regulatory (True = immutable regulatory record)
# WHY: Review existing labels before creating new ones to avoid duplicates
Get-ComplianceTag | Format-Table Name, RetentionDuration, RetentionAction, IsRecordLabel, Regulatory

# Check if any retention labels are currently published to users via policies
# WHAT: Lists all retention compliance policies and the labels they publish
# OUTPUT: Policy name, enabled status, mode, and published label names
# WHY: Labels must be published before users can apply them in Office apps
Get-RetentionCompliancePolicy | Format-Table Name, Enabled, Mode, @{
  N='Labels'; E={ ($_ | Get-RetentionComplianceRule).PublishComplianceTag -join ', ' }
}

# View existing event types for event-based retention
# WHAT: Lists all defined retention event types (e.g., Employee Departure, Contract Expiration)
# OUTPUT: Event type name, who created it, and when
# WHY: Event types must exist before creating event-based retention labels
Get-ComplianceRetentionEventType | Format-Table Name, CreatedBy, CreatedDateTime
💡 Pro Tip: The file plan is your single source of truth for records management. Export it regularly using Export all items to maintain an offline reference and for audit documentation. You can also import file plans via CSV for bulk label creation.

Step 2 · Create a File Plan with Record Labels

Create file plan descriptors that categorise your retention labels by business function, category, and regulatory citation. Then create record labels. both standard records (users can unlock) and regulatory records (immutable, nobody can unlock).

Portal Instructions

  1. Navigate to Records management > File plan
  2. Click the File plan descriptors link (or gear icon) to set up classification metadata:
    • Business function/department: add “Investment Banking”, “Equity Research”, “Compliance”, “Legal”
    • Category: add “Trading Records”, “Deal Documentation”, “Client Communications”, “Regulatory Filings”
    • Authority/citation: add “SEC Rule 17a-4”, “MiFID II Article 16”, “GDPR Article 5(1)(e)”
  3. Click Create a label (standard record):
    • Name: RM-DealDocumentation-7Y
    • Description: Retain deal documentation for 7 years then disposition review
    • File plan descriptors: Business function = Investment Banking, Category = Deal Documentation, Citation = SEC Rule 17a-4
    • Retention: Retain for 7 years from date created
    • At end of retention: Start a disposition review
    • Mark items as: A record (standard. users can unlock if needed)
  4. Create a second label (regulatory record):
    • Name: RM-TradingRecords-7Y-Regulatory
    • Mark items as: A regulatory record (immutable. nobody can remove or unlock)
    • Retention: Retain for 7 years from date created
    • At end of retention: Start a disposition review

PowerShell: Create Record Labels

# Create a standard record label with file plan descriptors
# WHAT: Creates a 7-year record label for deal documentation with metadata
# -RetentionDuration 2555: 7 years in days (365 x 7)
# -RetentionAction KeepAndDelete: Retain for 7 years, then trigger disposition review
# -RetentionType CreationAgeInDays: Retention clock starts from item creation date
# -ReviewerEmail: Compliance team receives disposition notifications when retention expires
# -IsRecordLabel $true: Items labeled become RECORDS (locked from editing/deletion)
# -Regulatory $false: Standard record - admins can unlock if needed (unlike regulatory records)
# -FilePlanProperty: Metadata descriptors for audit and governance documentation
#   Department, Category, Citation, and ReferenceId provide classification context
New-ComplianceTag -Name "RM-DealDocumentation-7Y" `
  -Comment "Retain deal documentation for 7 years. standard record" `
  -RetentionDuration 2555 `
  -RetentionAction KeepAndDelete `
  -RetentionType CreationAgeInDays `
  -ReviewerEmail "compliance-team@contoso.com" `
  -IsRecordLabel $true `
  -Regulatory $false `
  -FilePlanProperty @{
    FilePlanPropertyDepartment   = "Investment Banking";
    FilePlanPropertyCategory     = "Deal Documentation";
    FilePlanPropertyCitation     = "SEC Rule 17a-4";
    FilePlanPropertyReferenceId  = "RM-DD-001"
  }

# Create a regulatory record label (IMMUTABLE - cannot be unlocked by anyone)
# WHAT: Creates a 7-year immutable regulatory record for trading communications
# -Regulatory $true: CRITICAL - once applied, NO ONE (not even Global Admin) can:
#   - Remove the label
#   - Delete the item
#   - Modify the content
#   until the 7-year retention period expires
# WHY: SEC Rule 17a-4 requires WORM (Write Once Read Many) storage for trading records
# WARNING: Test with standard records first. Regulatory records are PERMANENT and IRREVERSIBLE.
New-ComplianceTag -Name "RM-TradingRecords-7Y-Regulatory" `
  -Comment "Trading records. 7 year regulatory record. immutable" `
  -RetentionDuration 2555 `
  -RetentionAction KeepAndDelete `
  -RetentionType CreationAgeInDays `
  -ReviewerEmail "compliance-team@contoso.com" `
  -IsRecordLabel $true `
  -Regulatory $true

# Publish both record labels via a retention label policy
# WHAT: Makes the labels available for manual application across all M365 locations
# NOTE: Labels become visible to users within 7 days of publishing
New-RetentionCompliancePolicy -Name "RM-InvestmentBanking-Policy" `
  -ExchangeLocation All `
  -SharePointLocation All `
  -OneDriveLocation All `
  -ModernGroupLocation All

# Attach the record labels to the policy
New-RetentionComplianceRule -Name "RM-IB-PublishLabels" `
  -Policy "RM-InvestmentBanking-Policy" `
  -PublishComplianceTag "RM-DealDocumentation-7Y","RM-TradingRecords-7Y-Regulatory"
⚠️ Important: Regulatory records are permanently immutable. Once a regulatory record label is applied, no one. not even a Global Administrator. can remove the label, delete the item, or modify its content until the retention period expires. Test thoroughly with standard record labels first before deploying regulatory labels.

Step 3 · Declare Regulatory Records

Apply regulatory record labels to critical business documents to enforce immutability. Once declared as a regulatory record, the item cannot be modified, deleted, or relabelled by anyone until the retention period expires.

Portal Instructions

  1. Navigate to a SharePoint document library containing trading communication records
  2. Select one or more documents > click the Details pane (ℹ️ icon)
  3. Under Apply retention label, select RM-TradingRecords-7Y-Regulatory
  4. Confirm the action. note the warning that this label cannot be removed
  5. Test immutability: try to edit the document. verify it is now read-only
  6. Test deletion: try to delete the document. verify deletion is blocked
  7. Test relabelling: try to change the label. verify the label cannot be changed
  8. Navigate to Records management > File plan > verify the label shows an increased item count

PowerShell: Apply Labels & Verify

# Connect to SharePoint Online using PnP PowerShell
# WHY: PnP module provides granular access to SharePoint items for label application
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/TradingDesk" -Interactive

# Apply regulatory record label to all documents in the Trading Communications library
# WHAT: Iterates through every document and applies the immutable regulatory record label
# WHY: Bulk application ensures comprehensive record declaration across the entire library
# WARNING: Once applied, these documents become PERMANENTLY read-only for 7 years
$items = Get-PnPListItem -List "Trading Communications" -Fields "FileLeafRef"

foreach ($item in $items) {
    # Apply the regulatory record label to each document
    Set-PnPListItem -List "Trading Communications" `
      -Identity $item.Id `
      -Label "RM-TradingRecords-7Y-Regulatory"
    Write-Host "Labelled: $($item.FieldValues.FileLeafRef)" -ForegroundColor Green
}

# Verify record status by checking the compliance tag on each document
# WHAT: Reads the applied retention label and application timestamp for each file
# OUTPUT: File name, applied label name, and the date/time the label was applied
# USE: Provides evidence for auditors that records were properly declared
# EXPECT: All files should show the regulatory record label with a recent timestamp
Get-PnPListItem -List "Trading Communications" -Fields "_ComplianceTag","_ComplianceTagWrittenTime" |
  Select-Object @{N='File';E={$_.FieldValues.FileLeafRef}},
    @{N='Label';E={$_.FieldValues._ComplianceTag}},
    @{N='Applied';E={$_.FieldValues._ComplianceTagWrittenTime}} |
  Format-Table -AutoSize
💡 Pro Tip: Use auto-apply retention label policies to automatically declare records based on sensitive information types, keywords, or trainable classifiers. This removes the burden from users and ensures consistent record declaration across the organisation.

Step 4 · Configure Event-Based Retention

Event-based retention starts the retention clock when a specific business event occurs. such as an employee leaving the company, a contract expiring, or a product reaching end of life. rather than from the date the content was created or modified.

Portal Instructions

  1. Navigate to Records management > Events
  2. Click Create to define an event type > name: Employee Departure
  3. Create another event type: Contract Expiration
  4. Navigate to File plan and create a new retention label:
    • Name: RM-EmployeeRecords-5Y-EventBased
    • Retention: Retain for 5 years
    • Start the retention period based on: An event > Employee Departure
    • At end of retention: Delete items automatically
  5. Publish the label to Exchange and SharePoint locations
  6. Apply the label to employee record documents and associate an Asset ID (e.g., the employee ID)
  7. When an employee leaves, create an event: select type Employee Departure, enter the Asset ID, and set the event date

PowerShell: Event-Based Retention

# Create event types for business events that trigger retention
# WHAT: Defines named event types used to start the retention clock on labeled content
# WHY: Event-based retention ensures records are kept for a fixed period AFTER a business
#      event occurs (e.g., keep employee records for 5 years after they leave)

# Employee Departure event - triggers retention when an employee leaves
New-ComplianceRetentionEventType -Name "Employee Departure" `
  -Comment "Triggers retention for employee-related records when an employee leaves"

# Contract Expiration event - triggers retention when a contract ends
New-ComplianceRetentionEventType -Name "Contract Expiration" `
  -Comment "Triggers retention for contract-related records when a contract expires"

# Create a retention label triggered by the Employee Departure event
# WHAT: 5-year retention label that starts counting when the departure event fires
# -RetentionType EventAgeInDays: Retention starts from the EVENT date, not creation date
# -EventType: Links this label to the "Employee Departure" event type
# -IsRecordLabel $true: Items are locked as records once labeled
# -Regulatory $false: Standard record - admins can unlock if needed
New-ComplianceTag -Name "RM-EmployeeRecords-5Y-EventBased" `
  -Comment "Retain employee records for 5 years after departure" `
  -RetentionDuration 1825 `
  -RetentionAction KeepAndDelete `
  -RetentionType EventAgeInDays `
  -EventType "Employee Departure" `
  -IsRecordLabel $true `
  -Regulatory $false

# Trigger a retention event when an employee departs
# WHAT: Fires the "Employee Departure" event, starting the 5-year retention clock
#       for all items tagged with the corresponding label AND matching Asset ID
# -SharePointAssetIdQuery: Matches items where ComplianceAssetId = EMP-004521
# -EventDateTime: The actual departure date (used to calculate retention expiry)
# WHY: This is typically automated via Power Automate or HR system integration
New-ComplianceRetentionEvent -Name "John Smith Departure" `
  -EventType "Employee Departure" `
  -SharePointAssetIdQuery "ComplianceAssetId:EMP-004521" `
  -EventDateTime "2026-03-07T00:00:00Z" `
  -Comment "Employee EMP-004521 departed on 2026-03-07"

# Verify the event was created and is being processed
# OUTPUT: Event name, type, date, and processing status (InProgress/Completed)
# EXPECT: Status should transition to "Completed" once all matching items are processed
Get-ComplianceRetentionEvent | Format-Table Name, EventType, EventDateTime, Status
💡 Pro Tip: Automate event creation with Microsoft Power Automate or the Microsoft Graph API. For example, trigger a retention event automatically when an employee’s account is disabled in Azure AD, or when a contract record is marked as expired in your contract management system.

Step 5 · Set Up Multi-Stage Disposition

When records reach the end of their retention period, disposition review allows designated reviewers to approve or extend retention before items are permanently deleted. Multi-stage disposition adds multiple approval layers for high-value records.

Portal Instructions

  1. Navigate to Records management > File plan
  2. Edit the label RM-TradingRecords-7Y-Regulatory > click Disposition settings
  3. Add Stage 1 reviewer: records-manager@contoso.com (Records Management team)
  4. Add Stage 2 reviewer: legal-team@contoso.com (Legal department)
  5. Add Stage 3 reviewer: cco@contoso.com (Chief Compliance Officer. final approval)
  6. Navigate to Records management > Disposition to review pending items
  7. For each item pending disposition:
    • Approve disposal. confirm the record can be permanently deleted
    • Extend retention. add an additional retention period (e.g., litigation hold)
    • Relabel. apply a different retention label
  8. After final stage approval, verify the Proof of disposal certificate is generated

PowerShell: Configure Disposition Reviewers

# Update a label to add multi-stage disposition reviewers
# WHAT: Configures three-stage approval for record destruction
# -ReviewerEmail: Array of reviewers who approve in sequence:
#   Stage 1: Records Manager (initial review)
#   Stage 2: Legal team (legal compliance check)
#   Stage 3: Chief Compliance Officer (final sign-off)
# WHY: Multi-stage disposition ensures no records are destroyed without
#      cross-functional approval - critical for regulated industries
Set-ComplianceTag -Identity "RM-TradingRecords-7Y-Regulatory" `
  -ReviewerEmail @(
    "records-manager@contoso.com",
    "legal-team@contoso.com",
    "cco@contoso.com"
  ) `
  -RetentionAction KeepAndDelete

# Check which labels have disposition reviewers assigned
# OUTPUT: Label name, retention duration, reviewer emails, and record status
# WHY: Validates that all record labels requiring review have reviewers assigned
Get-ComplianceTagStorage | Get-ComplianceTag |
  Where-Object { $_.ReviewerEmail -ne $null } |
  Format-Table Name, RetentionDuration, ReviewerEmail

# Export disposition audit log for compliance evidence
# WHAT: Retrieves all disposition decisions from the last 90 days
# -Operations: Captures both completed reviews and approved disposals
# OUTPUT: CSV file documenting every disposition decision for auditors
# WHY: Proof of disposal is legally required - auditors need evidence that
#      records were reviewed and approved before deletion
Search-UnifiedAuditLog `
  -StartDate (Get-Date).AddDays(-90) `
  -EndDate (Get-Date) `
  -Operations "DispositionReviewCompleted","DispositionApproved" `
  -ResultSize 5000 |
  Export-Csv -Path "DispositionAudit-90Days.csv" -NoTypeInformation
💡 Pro Tip: Always save the proof of disposal certificate generated after final approval. This document provides legally defensible evidence that records were destroyed according to your retention policy. critical during litigation or regulatory investigations when you need to prove records were not destroyed prematurely or retained too long.

Step 6 · Navigate to Information Barriers

Information Barriers (IB) enforce ethical walls by preventing communication and collaboration between specific groups of users. Before creating policies, you must understand the prerequisites and architecture of segments and policies.

Prerequisites & Architecture

  1. Azure AD Attributes. ensure the Department attribute (or other segmenting attribute) is populated for all users
  2. Directory Scoping. must be enabled: navigate to Information barriers > User Segments > verify scoping is active
  3. Audit logging. must be enabled for barrier enforcement tracking
  4. Architecture: IB works in two layers:
    • Segments. groups of users defined by Azure AD attributes (e.g., all users where Department = “Investment Banking”)
    • Policies. rules that block or allow communication between segments
  5. Navigate to compliance.microsoft.com > Information barriers
  6. Review the Segments tab and Policies tab
Information Barrier Architecture
Segments & Policies
Segment A
Investment Banking
Department = IB
Block Policy
IB ↔ ER
No communication
Segment B
Equity Research
Department = ER
Enforcement
Teams, SharePoint
OneDrive, Exchange

Step 7 · Create Information Barrier Segments

Define user segments based on Azure AD attributes. Each segment represents a group of users who share an attribute value. typically the Department attribute. Every user in your organisation should belong to exactly one segment.

Portal Instructions

  1. Navigate to Information barriers > Segments
  2. Click New segment
  3. Create segment: Investment Banking
    • Attribute: Department
    • Operator: Equals
    • Value: Investment Banking
  4. Create segment: Equity Research (Department = Equity Research)
  5. Create segment: Compliance (Department = Compliance)
  6. Create segment: Legal (Department = Legal)
  7. Create segment: General Staff (Department = General. for all other employees)

PowerShell: Create Segments

# Connect to Security & Compliance PowerShell
# WHY: Required for creating Information Barrier segments and policies
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Create user segments based on Azure AD Department attribute
# WHAT: Defines user groups for Information Barrier enforcement
# -UserGroupFilter: Matches users whose Department attribute equals the specified value
# WHY: Segments are the building blocks of Information Barriers - policies reference
#      these segments to define which groups can or cannot communicate
# PREREQUISITE: The Department attribute must be populated for ALL users in Entra ID

# Investment Banking segment - must be isolated from Equity Research
New-OrganizationSegment -Name "Investment Banking" `
  -UserGroupFilter "Department -eq 'Investment Banking'"

# Equity Research segment - must be isolated from Investment Banking
New-OrganizationSegment -Name "Equity Research" `
  -UserGroupFilter "Department -eq 'Equity Research'"

# Compliance segment - can communicate with ALL segments (shared service)
New-OrganizationSegment -Name "Compliance" `
  -UserGroupFilter "Department -eq 'Compliance'"

# Legal segment - can communicate with ALL segments (shared service)
New-OrganizationSegment -Name "Legal" `
  -UserGroupFilter "Department -eq 'Legal'"

# General Staff segment - all other employees
New-OrganizationSegment -Name "General Staff" `
  -UserGroupFilter "Department -eq 'General'"

# Verify all segments were created successfully
# OUTPUT: Segment name, filter query, and who created it
# CONCERN: Every user should fall into exactly ONE segment. Run:
#   Get-AzureADUser | Where-Object { -not $_.Department } to find unassigned users
Get-OrganizationSegment | Format-Table Name, UserGroupFilter, CreatedBy
⚠️ Important: Every user must belong to exactly one segment. Users not covered by any segment will not be affected by Information Barrier policies. Verify your Azure AD attribute coverage before proceeding. run Get-AzureADUser | Where-Object { -not $_.Department } to find users without a department set.

Step 8 · Create & Apply Information Barrier Policies

Create policies that block communication between conflicting segments (e.g., Investment Banking and Equity Research) and allow communication with shared services segments (e.g., Compliance and Legal). Then apply the policies to enforce the barriers.

Portal Instructions

  1. Navigate to Information barriers > Policies
  2. Click Create policy
  3. Create a Block policy:
    • Name: IB-Block-IB-ER
    • Assigned segment: Investment Banking
    • Communication and collaboration: Blocked
    • Segment to block: Equity Research
  4. Create the reciprocal block policy:
    • Name: IB-Block-ER-IB
    • Assigned segment: Equity Research
    • Communication and collaboration: Blocked
    • Segment to block: Investment Banking
  5. Create an Allow policy for Compliance (can communicate with all segments):
    • Name: IB-Allow-Compliance-All
    • Assigned segment: Compliance
    • Communication and collaboration: Allowed
    • Segments allowed: Investment Banking, Equity Research, Legal, General Staff
  6. Set all policies to Active state
  7. Click Apply all policies to start enforcement

PowerShell: Create & Apply Policies

# Block policy: Investment Banking CANNOT communicate with Equity Research
# WHAT: Creates an ethical wall preventing IB users from messaging ER users
# WHY: Financial regulations (MiFID II, SEC) require Chinese walls between
#      deal-making and research divisions to prevent insider trading
# -SegmentsBlocked: The target segment that the assigned segment cannot reach
# -State Active: Policy is immediately enforceable (pending application)
New-InformationBarrierPolicy -Name "IB-Block-IB-ER" `
  -AssignedSegment "Investment Banking" `
  -SegmentsBlocked "Equity Research" `
  -State Active

# Reciprocal block: Equity Research CANNOT communicate with Investment Banking
# WHY: IB policies are NOT bidirectional by default. Without this reciprocal policy,
#      ER users could still initiate contact with IB users. Always create BOTH sides.
New-InformationBarrierPolicy -Name "IB-Block-ER-IB" `
  -AssignedSegment "Equity Research" `
  -SegmentsBlocked "Investment Banking" `
  -State Active

# Allow policy: Compliance can communicate with ALL segments
# WHAT: Explicitly allows Compliance users to communicate across all barriers
# WHY: Compliance and Legal are "shared service" departments that must reach
#      all divisions to perform their oversight and investigation functions
# -SegmentsAllowed: List of all segments this group can communicate with
New-InformationBarrierPolicy -Name "IB-Allow-Compliance-All" `
  -AssignedSegment "Compliance" `
  -SegmentsAllowed "Investment Banking","Equity Research","Legal","General Staff" `
  -State Active

# Allow policy: Legal can communicate with ALL segments
New-InformationBarrierPolicy -Name "IB-Allow-Legal-All" `
  -AssignedSegment "Legal" `
  -SegmentsAllowed "Investment Banking","Equity Research","Compliance","General Staff" `
  -State Active

# CRITICAL: Apply all policies to begin enforcement
# WHAT: Triggers the actual enforcement of all Active policies across M365
# WHY: Policies are NOT enforced until this command is run. Creating policies
#      only defines them; this command activates barrier enforcement.
# NOTE: Application can take 30-60 minutes to propagate across all services
Start-InformationBarrierPoliciesApplication

# Check the application status - monitor until Status = "Completed"
# OUTPUT: Identity, Status (NotStarted/InProgress/Completed), and timestamp
# CONCERN: If Status stays at "Failed", check for segment conflicts or missing attributes
Get-InformationBarrierPoliciesApplicationStatus |
  Format-Table Identity, Status, LastModifiedTime
💡 Pro Tip: Information Barrier policies are bidirectional. you must create both sides of a block. If you only block Investment Banking from reaching Equity Research, ER users can still initiate communication with IB. Always create the reciprocal policy. Policy application can take 30–60 minutes; monitor the status before testing.

Step 9 · Test & Validate Information Barriers

After policies are applied, validate that barriers are enforced across Microsoft Teams, SharePoint Online, and OneDrive for Business. Test both blocked and allowed communication patterns.

Test Scenarios

  1. Teams Chat. Blocked: Sign in as an Investment Banking user, try to start a chat with an Equity Research user > verify the message is blocked with an IB policy notification
  2. Teams Chat. Allowed: Sign in as a Compliance user, start a chat with an Investment Banking user > verify the message goes through
  3. Teams Channel: Try to add an Equity Research user to an Investment Banking team > verify the addition is blocked
  4. SharePoint: As an IB user, try to share a document with an ER user > verify sharing is blocked
  5. OneDrive: Try to share a OneDrive file across barrier boundaries > verify the share is prevented
  6. People Picker: In Teams, search for an Equity Research user while signed in as Investment Banking > verify the user does not appear in search results
  7. Edge Case: Test a group chat that would span both segments. verify the system prevents creating such a group

PowerShell: Audit & Validate

# Check which IB policies apply to a specific user
# WHAT: Shows the user's segment membership and applied barrier policies
# WHY: Troubleshooting tool - verify a user is in the correct segment
#      and has the expected policies before/after testing
# OUTPUT: User identity, assigned segments, and applied IB policies
# CONCERN: If ExoSegments is empty, the user's Department attribute may not be set
Get-InformationBarrierRecipientStatus -Identity "john.smith@contoso.com" |
  Format-List Identity, ExoSegments, InformationBarrierPoliciesApplied

# Search audit logs for IB enforcement events
# WHAT: Retrieves all Information Barrier enforcement actions from the last 7 days
# WHY: Documents barrier enforcement for regulatory auditors and validates
#      that the policies are actually blocking communication as expected
# -RecordType InformationBarrierPolicyApplication: Filters to IB-specific events
# OUTPUT: Timestamp, affected user, operation type, policy name, and result
# CONCERN: Watch for "Failed" results - indicates enforcement issues
Search-UnifiedAuditLog `
  -StartDate (Get-Date).AddDays(-7) `
  -EndDate (Get-Date) `
  -RecordType InformationBarrierPolicyApplication `
  -ResultSize 500 |
  ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Timestamp  = $_.CreationDate
        User       = $_.UserIds
        Operation  = $data.Operation
        PolicyName = $data.PolicyName
        Result     = $data.ResultStatus
    }
  } | Format-Table -AutoSize

# List all IB policies with their current configuration
# OUTPUT: Policy name, assigned segment, blocked/allowed segments, and state
# EXPECT: All policies should show State = Active
Get-InformationBarrierPolicy |
  Format-Table Name, AssignedSegment, SegmentsBlocked, SegmentsAllowed, State
⚠️ Important: If barriers are not enforcing after 60 minutes, check for common issues: (1) users missing the Azure AD Department attribute, (2) users belonging to multiple or zero segments, (3) policies not set to Active state, or (4) the Start-InformationBarrierPoliciesApplication cmdlet not run after policy changes.

Step 10 · Navigate to Compliance Manager

Compliance Manager provides a centralised dashboard to assess your organisation’s compliance posture against over 300 regulatory templates. It calculates a compliance score based on improvement actions you’ve implemented.

Portal Instructions

  1. Navigate to compliance.microsoft.com > Compliance Manager
  2. Review the Overview dashboard:
    • Overall compliance score. percentage out of maximum achievable points
    • Key improvement actions. high-impact actions that will increase your score the most
    • Solutions that affect your score. which Microsoft 365 solutions contribute points
  3. Click Assessments > review the default Data Protection Baseline assessment
  4. Click Improvement actions > sort by Points achieved and Status
  5. Note actions marked Microsoft managed (automatically scored) vs Customer managed (you must implement and provide evidence)
  6. Click Assessment templates > browse available regulatory templates: ISO 27001, SOC 2, GDPR, HIPAA, PCI-DSS, NIST 800-53, and more
💡 Pro Tip: Microsoft-managed actions are scored automatically based on your tenant configuration. Focus your effort on customer-managed improvement actions. these are the ones you control and where you can make the biggest impact on your compliance score. Sort by Score impact to prioritise the highest-value actions first.

Step 11 · Run a Compliance Assessment

Create assessments against specific regulatory frameworks your organisation must comply with. Assign improvement actions to responsible teams, track completion status, and export assessment reports for auditors.

Portal Instructions

  1. Navigate to Compliance Manager > Assessments > click Add assessment
  2. Select a regulatory template. for this lab, choose ISO 27001:2013
  3. Name: ISO 27001. Annual Assessment 2026
  4. Assessment group: create a new group 2026 Regulatory Assessments
  5. Click Create. the assessment is built with all applicable controls and improvement actions
  6. Repeat for SOC 2 Type II and GDPR templates
  7. Open the ISO 27001 assessment > review:
    • Controls. mapped to ISO 27001 Annex A controls
    • Your improvement actions. customer-managed actions to implement
    • Microsoft actions. automatically scored based on your configuration
  8. For each customer-managed improvement action:
    • Click the action > assign to a responsible person (e.g., IT Security Manager)
    • Set implementation status: Not implemented, Implemented, Alternative implementation, or Planned
    • Set test status: None, Passed, Failed. low risk, Failed. medium risk, Failed. high risk
    • Upload evidence documents: screenshots, policy documents, configuration exports
    • Add implementation notes describing what was done and when
  9. Monitor the assessment completion percentage and score as actions are completed
  10. Click Generate report to export a PDF/Excel report for auditors

PowerShell: Export Compliance Data

# Note: Compliance Manager data is primarily managed via the portal.
# Use the Microsoft Graph API for programmatic access to compliance data.

# Install Microsoft Graph PowerShell module for API access
Install-Module Microsoft.Graph -Scope CurrentUser -Force

# Connect to Microsoft Graph with Compliance Manager read permissions
# -Scopes: Requests read-only access to Compliance Manager data
Connect-MgGraph -Scopes "ComplianceManager.Read.All"

# List compliance assessments via Graph API
# NOTE: Compliance Manager API availability may vary; check current Graph API docs
$assessments = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/compliance/ediscovery/cases" `
  -OutputType PSObject

# Retrieve sensitivity label information via Graph API
$actions = Invoke-MgGraphRequest -Method GET `
  -Uri "https://graph.microsoft.com/beta/security/informationProtection/sensitivityLabels" `
  -OutputType PSObject

# RECOMMENDED: Use the Compliance Manager portal for comprehensive reporting
# The portal provides richer export options than the API currently supports
Write-Host "For comprehensive reporting, use the Compliance Manager portal:" -ForegroundColor Cyan
Write-Host "  1. Open Compliance Manager > Assessments" -ForegroundColor White
Write-Host "  2. Select your assessment (e.g., ISO 27001)" -ForegroundColor White
Write-Host "  3. Click 'Generate report' for PDF or 'Export to Excel'" -ForegroundColor White
Write-Host "  4. Share the report with auditors and leadership" -ForegroundColor White
💡 Pro Tip: Set a target compliance score of 85% or higher for each assessment. Assign improvement actions to specific team members with deadlines. Schedule a monthly review meeting to track progress, update statuses, and address any failed test actions. Auditors value evidence of continuous improvement over a perfect score. upload evidence documents for every action you complete.

Step 12 · Clean Up & Next Steps

Review your deployment across all three solutions and establish ongoing operational procedures.

What You Accomplished

  1. Records Management. File plan with standard and regulatory record labels deployed
  2. Event-Based Retention. Retention triggered by employee departure and contract expiration events
  3. Multi-Stage Disposition. Three-stage approval workflow for record destruction with proof of disposal
  4. Information Barrier Segments. Five segments defined based on Azure AD Department attribute
  5. Information Barrier Policies. Chinese walls enforced between Investment Banking and Equity Research
  6. Compliance Manager Assessments. ISO 27001, SOC 2, and GDPR assessments with assigned improvement actions

Operational Procedures

  • Weekly: Review pending disposition items and approve/extend as needed
  • Weekly: Monitor Information Barrier audit logs for enforcement anomalies
  • Monthly: Review Compliance Manager scores and update improvement action statuses
  • Quarterly: Review and update file plan descriptors and retention schedules
  • Quarterly: Validate Information Barrier segments against Azure AD attribute changes (new hires, department transfers)
  • Annually: Generate full compliance assessment reports for external auditors

Next Steps

  • Next Lab: Data Security Posture Management for AI Workloads
  • Implement auto-apply retention label policies with trainable classifiers for automatic record declaration
  • Configure Power Automate flows to automatically trigger retention events from HR and contract management systems
  • Extend Information Barriers to Exchange Online for email communication blocking
  • Add premium assessment templates in Compliance Manager for industry-specific regulations (FINRA, SOX, CCPA)
  • Integrate Compliance Manager scores into your executive dashboard for board-level reporting

PowerShell: Verify Full Deployment

# FULL DEPLOYMENT VERIFICATION SCRIPT
# Run this after completing all steps to confirm everything is configured correctly

# --- Records Management Verification ---
Write-Host "=== Records Management ===" -ForegroundColor Cyan

# List all record labels (standard and regulatory)
# OUTPUT: Label name, retention duration, whether it's a regulatory record, and reviewer
# EXPECT: At least 2 record labels (deal documentation and trading records)
Get-ComplianceTag |
  Where-Object { $_.IsRecordLabel -eq $true } |
  Format-Table Name, RetentionDuration, Regulatory, ReviewerEmail

# List all event types for event-based retention
# OUTPUT: Event type names and creation dates
# EXPECT: "Employee Departure" and "Contract Expiration" events
Get-ComplianceRetentionEventType | Format-Table Name, CreatedDateTime

# --- Information Barriers Verification ---
Write-Host "`n=== Information Barriers ===" -ForegroundColor Cyan

# List all user segments and their filter queries
# OUTPUT: Segment names and the Azure AD attribute filters
# EXPECT: 5 segments (IB, ER, Compliance, Legal, General Staff)
Get-OrganizationSegment | Format-Table Name, UserGroupFilter

# List all IB policies with their block/allow configuration
# OUTPUT: Policy name, assigned segment, blocked/allowed segments, and state
# EXPECT: 2 block policies (IB-ER bidirectional) and 2 allow policies (Compliance, Legal)
Get-InformationBarrierPolicy |
  Format-Table Name, AssignedSegment, SegmentsBlocked, SegmentsAllowed, State

# Confirm policy application completed successfully
# OUTPUT: Application status and timestamp
# EXPECT: Status = "Completed" (if still "InProgress", wait and re-check)
Get-InformationBarrierPoliciesApplicationStatus |
  Format-List Identity, Status, LastModifiedTime

# --- Summary ---
Write-Host "`n=== Deployment Complete ===" -ForegroundColor Green
Write-Host "Records Management: File plan with regulatory records deployed" -ForegroundColor White
Write-Host "Information Barriers: Chinese walls enforced between IB and ER" -ForegroundColor White
Write-Host "Compliance Manager: Assessments configured via portal" -ForegroundColor White
💡 Pro Tip: These three solutions work together to create a comprehensive compliance programme. Records Management provides legally defensible data lifecycle management, Information Barriers enforce ethical walls required by financial regulations, and Compliance Manager ties it all together with measurable assessments and evidence. Document your configurations and export reports regularly. auditors will want to see both the technical controls and the governance processes around them.

📚 Documentation Resources

ResourceDescription
Learn about records managementOverview of records management in Microsoft Purview
Declare recordsDeclare standard and regulatory records with retention labels
Start retention with an eventEvent-based retention for records management
Disposition of contentMulti-stage disposition review and proof of disposal
Learn about information barriersOverview of Information Barriers in Microsoft 365
Define information barrier policiesCreate segments and policies for Information Barriers
Microsoft Purview Compliance ManagerOverview of Compliance Manager and compliance score
Build and manage assessmentsCreate assessments from regulatory templates
← Previous Lab Next Lab →