informationBarrierSegments

Information Barrier Segments. Define user segments that barrier policies are written against. The informationBarrierSegments entity set lives under /exchange/v1.0/informationBarrierSegments in the Governance & protection category.

Fact	Value
Path	`/exchange/v1.0/informationBarrierSegments`
Category	Governance & protection
Tier	Tier 5, Compliance
Read role	`Compliance.IPPS.Read.All` (Community)
Write role	`Compliance.IPPS.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-ExoInformationBarrierSegment, New-OrganizationSegment, Set-OrganizationSegment, Remove-OrganizationSegment

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/informationBarrierSegments`	List informationBarrierSegments entries.	`Compliance.IPPS.Read`	Community
POST	`/exchange/v1.0/informationBarrierSegments`	Create a new informationBarrierSegments entry via New-OrganizationSegment (IPPS pool). Body keys map 1:1 to cmdlet params (camelCased). Required: name + userGroupFilter (OPATH against Entra users, e.g. “Department -eq ‘Finance’”). Returns 201 + Location + the freshly-fetched segment.	`Compliance.IPPS.ReadWrite`	Enterprise
GET	`/exchange/v1.0/informationBarrierSegments/{key}`	Get a single informationBarrierSegments entry by Identity.	`Compliance.IPPS.Read`	Community
PATCH	`/exchange/v1.0/informationBarrierSegments/{key}`	Partial update via Set-OrganizationSegment (IPPS pool). Only userGroupFilter is mutable post-creation. Returns 200 + the post-Set segment.	`Compliance.IPPS.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/informationBarrierSegments/{key}`	Remove the informationBarrierSegments at /{key}. Returns 204. The cmdlet rejects removal if any active InformationBarrierPolicy references this segment as its assignedSegment, segmentsAllowed, or segmentsBlocked.	`Compliance.IPPS.ReadWrite`	Enterprise

GET /exchange/v1.0/informationBarrierSegments

List informationBarrierSegments entries.

Backing cmdlet: Get-ExoInformationBarrierSegment. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
`showFriendlyValues`	query	bool (switch)		Show enum-typed fields as human-readable strings (slower).

List EXO information barrier segments

Lists user-population segments via Get-ExoInformationBarrierSegment. Each segment defines a recipient filter (e.g. Department -eq ‘Research’) used by information barrier policies. Routes through the EXO pool - Wiki applicable: Exchange Online.

GET /exchange/v1.0/informationBarrierSegments HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#informationBarrierSegments",
  "value": [
    {
      "Id": "segment-finance-guid",
      "Name": "Finance",
      "Identity": "segment-finance-guid",
      "UserGroupFilter": "Department -eq 'Finance'",
      "Type": "UserGroup"
    },
    {
      "Id": "segment-research-guid",
      "Name": "Research",
      "Identity": "segment-research-guid",
      "UserGroupFilter": "Department -eq 'Research'",
      "Type": "UserGroup"
    }
  ]
}

POST /exchange/v1.0/informationBarrierSegments

Create a new informationBarrierSegments entry via New-OrganizationSegment (IPPS pool). Body keys map 1:1 to cmdlet params (camelCased). Required: name + userGroupFilter (OPATH against Entra users, e.g. “Department -eq ‘Finance’”). Returns 201 + Location + the freshly-fetched segment.

A segment defines a population of users (filter-based) that information barrier policies can apply to. The userGroupFilter uses Entra user attribute OPATH (e.g. “Department -eq ‘Research’”); see Wiki for supported attributes. After creating segments + policies, run POST /informationBarrierPolicies/applyAll to push the rules tenant-wide. IPPS-side - controller passes omitConfirm: true.

Backing cmdlet: New-OrganizationSegment. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required
`name`	body		yes
`userGroupFilter`	body		yes
`dryRun`	query	bool (switch)

Create fails when a required field is missing

New-OrganizationSegment requires both name and userGroupFilter. Omitting userGroupFilter yields a 400 from the body-allowlist validation before the cmdlet is invoked.

POST /exchange/v1.0/informationBarrierSegments HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-informationBarrierSegments"
}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{
  "error": {
    "code": "BadRequest",
    "message": "The required field 'userGroupFilter' is missing from the request body.",
    "target": "userGroupFilter"
  },
  "correlationId": "0HN7QK2J3M4P5Q6R7S8T9U0V"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

Create an information barrier segment

Creates a user-population segment via New-OrganizationSegment (IPPS pool). The userGroupFilter is an OPATH expression over Entra user attributes; after creating segments and policies, run POST /informationBarrierPolicies/applyAll to push the rules tenant-wide.

POST /exchange/v1.0/informationBarrierSegments HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "exonaut-sample-informationBarrierSegments",
  "userGroupFilter": "Department -eq 'Finance'"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/informationBarrierSegments/exonaut-sample-informationBarrierSegments

{
  "Id": "exonaut-sample-informationBarrierSegments",
  "Identity": "exonaut-sample-informationBarrierSegments",
  "Name": "exonaut-sample-informationBarrierSegments",
  "UserGroupFilter": "Department -eq 'Finance'"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

GET /exchange/v1.0/informationBarrierSegments/{key}

Get a single informationBarrierSegments entry by Identity.

Backing cmdlet: Get-ExoInformationBarrierSegment. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
`showFriendlyValues`	query	bool (switch)		Show enum-typed fields as human-readable strings (e.g. FriendlyMembershipFilter); slower.

PATCH /exchange/v1.0/informationBarrierSegments/{key}

Partial update via Set-OrganizationSegment (IPPS pool). Only userGroupFilter is mutable post-creation. Returns 200 + the post-Set segment.

Changing a segment’s filter does NOT automatically re-evaluate existing policy rules - call POST /informationBarrierPolicies/applyAll after PATCH to push the change tenant-wide. IPPS-side - omitConfirm: true.

Backing cmdlet: Set-OrganizationSegment. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`userGroupFilter`	body
`dryRun`	query	bool (switch)

Update an information barrier segment filter

Partial update via Set-OrganizationSegment (IPPS pool). Only userGroupFilter is mutable post-creation; changing it does not auto-re-evaluate existing policy rules, so call POST /informationBarrierPolicies/applyAll afterward.

PATCH /exchange/v1.0/informationBarrierSegments/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "userGroupFilter": "Department -eq 'Research'"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-informationBarrierSegments",
  "Identity": "exonaut-sample-informationBarrierSegments",
  "Name": "exonaut-sample-informationBarrierSegments",
  "UserGroupFilter": "Department -eq 'Research'"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/informationBarrierSegments/{key}

Remove the informationBarrierSegments at /{key}. Returns 204. The cmdlet rejects removal if any active InformationBarrierPolicy references this segment as its assignedSegment, segmentsAllowed, or segmentsBlocked.

Backing cmdlet: Remove-OrganizationSegment. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete an information barrier segment

Removes the segment via Remove-OrganizationSegment (IPPS pool). The cmdlet rejects removal if any active InformationBarrierPolicy references this segment as its assignedSegment, segmentsAllowed, or segmentsBlocked.

DELETE /exchange/v1.0/informationBarrierSegments/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.