Information Barrier Processor disabled by Microsoft.

Question

Information Barrier Processor disabled by Microsoft.

yukai9jo KQst816 0

Admin consent for IB in Microsoft Teams is included in the 1st step of Information Barriers in the public information below.

https://learn.microsoft.com/en-us/purview/information-barriers-policies#step-1-make-sure-prerequisites-are-met

When I run the mentioned command, I get the error below.

AADSTS7000112: Application 'bcf62038-e005-436d-b970-2a472f8c1982'(Information Barrier Processor) is disabled. Trace ID: d92145c9-571e-4010-9a63-7bde646f4000

When I view All apps for this Application ID in Microsoft Entra ID, Information Barrier Processor disabled by Microsoft. is displayed.

Currently, attempting to activate the Information Barriers policy results in an error.

Therefore, I would like to implement Admin consent for IB in Microsoft Teams and see if it resolves the issue, but for that purpose I would like to release the disable.

How can I turn it off?
User's image

Bhargava-MSFT 31,361 Reputation points Microsoft Employee Moderator

2024-03-01T20:08:41.2133333+00:00

Hello yukai9jo KQst816,

from the below documment, To manage IB policies, you must be assigned one of the following roles:

Microsoft 365 global administrator Office 365 global administrator Compliance administrator IB Compliance Management

https://learn.microsoft.com/en-us/purview/information-barriers-policies

Can you please check your roles?

Please check the below document for Grant and manage consent to Teams app permissions.

https://learn.microsoft.com/en-us/microsoftteams/manage-consent-app-permissions

You can try to enable or disable user discoverability restrictions in IB using the PowerShell cmdlet Set-PolicyConfig(please see the below techcommunity document). Once user discoverability restricted by IB is turned off, users can discover each other in the people picker, independent of their IB policies. By default, the people picker restriction is enabled for all IB policies.

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/information-barriers-v2-is-now-generally-available-for-all-new/ba-p/3757781

I hope this helps.
yukai9jo KQst816 0 Reputation points

2024-03-04T01:11:41.6333333+00:00

Thank you for contacting us.

The user running it has been granted the Global Administrator role, so there should be no issues enabling the IB policy or granting permissions to the application.

Granting administrator consent is an error both when I run it through PowerShell and from GUI of Microsoft Entra ID, and the reason is that "Information Barrier Processor" as described is AppID "bcf62038-e005-" 436d-b970-2a472f8c1982" app is disabled.

As stated in the Information Barriers public information, this step is stated to be executed before creating the IB policy, but before creating the IB policy, the app as AppID "bcf62038-e005-436d-b970-2a472f8c1982" doesn't exist in the tenant. and after creating an IB policy, I can see it in my Microsoft Entra ID with the status "This application has been disabled by Microsoft".

I believe that the reason I can't enable IB policy is because I can't grant administrator consent to this app.

Is it possible to grant admin consent for AppID "bcf62038-e005-436d-b970-2a472f8c1982" with "This application has been desabled by Microsoft"?
Bhargava-MSFT 31,361 Reputation points Microsoft Employee Moderator

2024-03-07T00:15:46.2033333+00:00

Hello yukai9jo KQst816, Thank you for providing additional details. I attempted to reach out to my internal team, but I haven't received any response from them. As for the next steps, if you have a support plan, please submit a support request. If you don't have a support plan, please let me know so that I can enable a one-time free support request to work on this case. I am looking forward to hearing from you.

1 answer

Your answer

Bhargava-MSFT 31,361 Reputation points Microsoft Employee Moderator

2024-03-01T20:08:41.2133333+00:00

Hello yukai9jo KQst816,

from the below documment, To manage IB policies, you must be assigned one of the following roles:

Microsoft 365 global administrator Office 365 global administrator Compliance administrator IB Compliance Management

https://learn.microsoft.com/en-us/purview/information-barriers-policies

Can you please check your roles?

Please check the below document for Grant and manage consent to Teams app permissions.

https://learn.microsoft.com/en-us/microsoftteams/manage-consent-app-permissions

You can try to enable or disable user discoverability restrictions in IB using the PowerShell cmdlet Set-PolicyConfig(please see the below techcommunity document). Once user discoverability restricted by IB is turned off, users can discover each other in the people picker, independent of their IB policies. By default, the people picker restriction is enabled for all IB policies.

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/information-barriers-v2-is-now-generally-available-for-all-new/ba-p/3757781

I hope this helps.
yukai9jo KQst816 0 Reputation points

2024-03-04T01:11:41.6333333+00:00

Thank you for contacting us.

The user running it has been granted the Global Administrator role, so there should be no issues enabling the IB policy or granting permissions to the application.

Granting administrator consent is an error both when I run it through PowerShell and from GUI of Microsoft Entra ID, and the reason is that "Information Barrier Processor" as described is AppID "bcf62038-e005-" 436d-b970-2a472f8c1982" app is disabled.

As stated in the Information Barriers public information, this step is stated to be executed before creating the IB policy, but before creating the IB policy, the app as AppID "bcf62038-e005-436d-b970-2a472f8c1982" doesn't exist in the tenant. and after creating an IB policy, I can see it in my Microsoft Entra ID with the status "This application has been disabled by Microsoft".

I believe that the reason I can't enable IB policy is because I can't grant administrator consent to this app.

Is it possible to grant admin consent for AppID "bcf62038-e005-436d-b970-2a472f8c1982" with "This application has been desabled by Microsoft"?
Bhargava-MSFT 31,361 Reputation points Microsoft Employee Moderator

2024-03-07T00:15:46.2033333+00:00

Hello yukai9jo KQst816, Thank you for providing additional details. I attempted to reach out to my internal team, but I haven't received any response from them. As for the next steps, if you have a support plan, please submit a support request. If you don't have a support plan, please let me know so that I can enable a one-time free support request to work on this case. I am looking forward to hearing from you.

Answer 1

yukai9jo KQst816 0

When I checked today, Grant admin consent was still not possible due to Application 'bcf62038-e005-436d-b970-2a472f8c1982'(Information Barrier Processor) is disabled., but I was able to enable the policy. There may have been some issue with the tenant, but SHD was unable to confirm any information regarding this issue.Thank you for your help.

Bhargava-MSFT 31,361 Reputation points Microsoft Employee Moderator

2024-03-11T20:08:59.35+00:00

Hello yukai9jo KQst816,

I’m glad to hear that you were able to enable the policy.

Share via

Information Barrier Processor disabled by Microsoft.

1 answer

Your answer