Reinforcing data protection with watermark protection in Microsoft Edge

This week is all about watermark protection in Microsoft Edge. Watermark protection is focused on visibly reinforcing data protection in Microsoft Edge, and that reinforcement is achieved by overlaying a watermark on sensitive data when viewed in the browser. Watermark protection in Microsoft Edge is – like in any other Microsoft solution – designed to discourage sharing screenshots, support compliance requirements, and increase the awareness of users when handling sensitive data. With that, watermark protection does not technically prevent users from sharing sensitive data, but it does make the user aware of the sensitivity of the data. And on top of that, it will become a lot easier to understand the source of a potential data leakage. This post will provide a closer look on this relatively new feature, the configuration, and the user experience.

Note: At this moment watermark protection is in preview and only available in the targeted release of Microsoft 365.

Enabling watermark protection in Microsoft Edge

Watermark protection on itself is pretty straightforward and the user will see a semi-transparent overlay across the whole content area of Microsoft Edge. Before looking at configuring watermark protection, it is important to understand when those watermarks are applied. Watermarking is not applied purely based on the existence of a sensitivity label. Instead, watermarking appears when labels enforce specific restrictions like blocking copy, or upload actions. That means that when expecting content or a a site to be watermarked, make sure that it is receiving the data loss prevention restriction from a provider like Microsoft Purview, Microsoft Intune, or Microsoft Entra.

When looking at the configuration of watermark protection, it all comes down to the Microsoft Edge management service. Even though watermark protection is a browser configuration, it is currently not available via other configuration providers, such as Microsoft Intune. That means that the configuration can be done via the Microsoft 365 admin center portal. The following number of steps walkthrough enabling watermark protection for all the assigned users.

1. Open the Microsoft 365 admin center portal and navigate to Setting > Microsoft Edge
2. On the Microsoft Edge for Business page, navigate to the Configuration policies tab and select an existing policy or create a new policy and select that policy
3. Navigate to the Customization Settings tab, select the Security settings section, as shown below in Figure 1, and select Enabled with Enable watermarking protection to enable watermarking for all assigned users of the policy

Note: This configuration is currently only configurable for the Cloud policy type and not for the Intune policy type.

Experiencing watermark protection in Microsoft Edge

When watermark protection is enabled in Microsoft Edge, it is pretty straightforward for users to experience the behavior. The watermarking appears automatically on any sensitive data that meets criteria such as pages labeled via Microsoft Purview or those subject to Data Loss Prevention (DLP) enforcement. It is rendered by the Microsoft Edge and it cannot be removed or altered by the user. The default string that is used for watermarking is: “Confidential – Don’t share” Username Timestamp. An example is shown below in Figure 2, when opening a local PDF with sensitivity labeling. That example clearly shows the watermark in Microsoft Edge. Besides that, it also visible that the file is protected by a sensitivity label.

There are multiple surface types that are supported for watermark protection in Microsoft Edge. The table below provides an overview of those surfaces and the support.

Surface type	Supported
Regular browser tabs
Split screen tabs
Pop-up windows and app windows
Local PDFs with sensitivity labeling
MIP-labeled PDFs
Printing and screenshots
Sidebar and shoreline surfaces
Reading mode

Note: Not supported surface types are still work in progress.

More information

For more information about watermark protection in Microsoft Edge, refer to the following docs.

• Watermark Protection | Microsoft Learn