Managing SharePoint Sensitivity Label Watermarks: Layout Options and Accessibility Considerations

Sensitivity labels in SharePoint Online provide visual indicators through watermarks to help users identify classified content. However, the default diagonal watermark layout can present usability and accessibility challenges. This guide explores watermark configuration options, addresses common user concerns, and provides solutions for managing watermark display in SharePoint documents.

Table of Contents

Understanding Sensitivity Label Watermarks

Sensitivity label watermarks are visual indicators that appear on documents to display the classification level of content. These watermarks help users:

  • Identify Classification: Instantly recognize the sensitivity level of documents
  • Maintain Compliance: Ensure proper handling of classified information
  • Prevent Data Leakage: Provide visual reminders about information protection policies
  • Support Governance: Enforce organizational data classification standards

Key Features:

  • Applied automatically based on sensitivity label configuration
  • Visible when viewing documents in SharePoint Online
  • Configurable at both tenant and file levels
  • Support different layout orientations

Watermark Layout Options

Microsoft Purview provides two primary layout options for sensitivity label watermarks in SharePoint:

Diagonal Layout

  • Appearance: Watermark text displayed at a 45-degree angle across the document
  • Visibility: Highly prominent and difficult to ignore
  • Use Case: Maximum visual impact for highly sensitive content

Horizontal Layout

  • Appearance: Watermark text displayed horizontally across the document
  • Visibility: Less intrusive while maintaining classification awareness
  • Use Case: Better readability and accessibility compliance

Watermark Layout Options

Comparison Table

AspectDiagonal LayoutHorizontal Layout
VisibilityVery highModerate
ReadabilityCan be difficultBetter readability
AccessibilityMay cause issues for screen readersMore accessible
User FeedbackOften reported as distractingGenerally preferred
Document ClarityCan obscure contentLess intrusive

User Experience and Accessibility Concerns

Organizations implementing diagonal watermarks have received feedback from end users highlighting several concerns:

Common User Complaints

  1. Distracting Visual Element

    • Diagonal watermarks can make it difficult to focus on document content
    • The angled text competes for attention with the actual information
    • Users report eye strain when working with watermarked documents for extended periods

  2. Accessibility Challenges

    • Screen readers may struggle to interpret diagonal text
    • Users with visual impairments find diagonal watermarks harder to read
    • Does not meet WCAG (Web Content Accessibility Guidelines) standards
    • Creates barriers for users with cognitive disabilities

  3. Document Usability

    • Makes it harder to scan and read documents quickly
    • Can obscure important content or graphics
    • Reduces overall document clarity and professionalism

Accessibility Compliance

Organizations with accessibility requirements should consider:

  • WCAG 2.1 Guidelines: Diagonal text may violate success criteria for perceivability
  • Section 508 Compliance: Horizontal layouts better support assistive technologies
  • Inclusive Design: Horizontal watermarks accommodate diverse user needs
  • Legal Requirements: Some jurisdictions mandate accessible document formats

Configuring Watermark Layout at Tenant Level

Administrators can configure the default watermark layout for the entire tenant through Microsoft Purview compliance portal.

Steps to Configure Tenant-Level Settings

  1. Access Microsoft Purview Compliance Portal

  2. Navigate to Sensitivity Labels

    • Go to Information protection > Labels
    • Select the sensitivity label you want to configure

  3. Edit Label Settings

    • Click on the label to edit its properties
    • Navigate to Content marking settings
    • Under Watermark section, configure the layout

  4. Choose Layout Option

    • Select either Diagonal or Horizontal layout
    • Preview how the watermark will appear
    • Save your changes

  5. Publish Label Policy

    • Ensure the updated label is published to the appropriate users/groups
    • Changes may take up to 24 hours to propagate

PowerShell Configuration

For automated or bulk configuration, use PowerShell:

# Connect to Security & Compliance Center
Connect-IPPSSession

# Get the label
$label = Get-Label -Identity "Confidential"

# Configure watermark with horizontal layout
Set-Label -Identity $label.Guid `
    -AdvancedSettings @{
        watermarklayout = "Horizontal"
        watermarktext = "CONFIDENTIAL"
        watermarkfontsize = "12"
        watermarkfontcolor = "#FF0000"
    }

# Verify configuration
Get-Label -Identity "Confidential" | Format-List DisplayName, AdvancedSettings

Configuration Options

# Available watermark settings
$watermarkSettings = @{
    watermarklayout = "Horizontal" # or "Diagonal"
    watermarktext = "CONFIDENTIAL"
    watermarkfontsize = "12" # Font size in points
    watermarkfontcolor = "#808080" # Gray color
    watermarkfontname = "Calibri"
}

Managing Watermarks at File Level

While tenant-level settings define the default behavior, users can manage watermarks at the individual file level.

Removing Watermarks from Individual Files

Important: Users can only remove watermarks if they have appropriate permissions and the label allows it.

Method 1: Through SharePoint Online

  1. Open the document in SharePoint Online
  2. Click on the Sensitivity button in the toolbar
  3. Review the current sensitivity label
  4. If allowed by policy, you can:
    • Remove the sensitivity label entirely (removes watermark)
    • Change to a label without watermark configuration

Method 2: Through Office Applications

  1. Open the document in Word, Excel, or PowerPoint
  2. Go to File > Info
  3. Click on Sensitivity label
  4. Modify or remove the label as permitted by policy

Method 3: Using PowerShell

# Connect to SharePoint Online
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/yoursite" -Interactive

# Get the file
$file = Get-PnPFile -Url "/sites/yoursite/Shared Documents/document.docx"

# Remove sensitivity label (and watermark)
Set-PnPFileSensitivityLabel -Identity $file -RemoveLabel

# Or change to a different label
Set-PnPFileSensitivityLabel -Identity $file -LabelId "new-label-guid"

Permissions Required

To modify sensitivity labels on files, users need:

  • Edit permissions on the file
  • Permission to change labels (configured in label policy)
  • Appropriate role if label requires elevated privileges

Troubleshooting Watermark Refresh Issues

Sometimes after updating sensitivity labels, watermarks don’t refresh properly. This is a known behavior in SharePoint Online.

Common Symptoms

  • Watermark displays old label information
  • Layout changes don’t apply immediately
  • Watermark appears inconsistently across documents
  • Changes visible in admin portal but not on documents

Root Causes

  1. Caching Issues: SharePoint and Office applications cache label information
  2. Propagation Delays: Label policy updates can take up to 24 hours
  3. Client-Side Caching: Local Office applications may have outdated label info
  4. Sync Conflicts: OneDrive sync can cause temporary inconsistencies

Solutions

Solution 1: Re-apply the Sensitivity Label

The most reliable method to refresh watermarks:

# Connect to SharePoint
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/yoursite" -Interactive

# Get files with specific label
$files = Get-PnPListItem -List "Documents" -PageSize 500

foreach ($file in $files) {
    $currentLabel = Get-PnPFileSensitivityLabel -Identity $file.FieldValues.FileRef
    
    if ($currentLabel) {
        # Re-apply the same label to force refresh
        Set-PnPFileSensitivityLabel -Identity $file.FieldValues.FileRef -LabelId $currentLabel.Id
        Write-Host "Refreshed watermark for: $($file.FieldValues.FileLeafRef)" -ForegroundColor Green
    }
}

Solution 2: Clear Office Cache

For individual user issues:

  1. Clear Office Application Cache:

    • Close all Office applications
    • Navigate to: %localappdata%\Microsoft\Office\16.0\OfficeFileCache
    • Delete cache files
    • Restart Office applications

  2. Clear Browser Cache:

    • Clear browser cache and cookies
    • Sign out and sign back into SharePoint Online

  3. Reset OneDrive Sync:

    • Pause OneDrive sync
    • Wait 5 minutes
    • Resume sync

Solution 3: Force Policy Refresh

# Force label policy sync for a user
Connect-IPPSSession

# Trigger policy refresh
Set-LabelPolicy -Identity "Global Policy" -Force

# Or create a new policy version
$policy = Get-LabelPolicy -Identity "Global Policy"
Set-LabelPolicy -Identity $policy.Guid -Comment "Force refresh - $(Get-Date)"

Solution 4: Wait for Propagation

Sometimes patience is the best solution:

  • Initial deployment: Allow up to 24 hours
  • Policy updates: Wait 4-6 hours for changes to propagate
  • Large tenants: May require 24-48 hours for full propagation

Verification Steps

# Verify label policy status
Connect-IPPSSession

# Check label configuration
Get-Label -Identity "Confidential" | 
    Select-Object DisplayName, Guid, AdvancedSettings

# Check policy distribution
Get-LabelPolicy | 
    Select-Object Name, DistributionStatus, LastModifiedTime

# Check specific file label
Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/yoursite" -Interactive
$label = Get-PnPFileSensitivityLabel -Url "/sites/yoursite/Shared Documents/document.docx"
$label | Format-List

Best Practices

For Administrators

  1. Choose User-Friendly Layouts

    • Default to horizontal layout for better accessibility
    • Reserve diagonal layout for highest sensitivity classifications only
    • Test watermark visibility with end users before broad deployment

  2. Plan for Accessibility

    • Conduct accessibility reviews of watermark configurations
    • Provide alternative text or metadata for screen readers
    • Document accessibility compliance in governance policies

  3. Communicate Changes

    • Notify users before changing watermark layouts
    • Provide training on label changes and their implications
    • Create documentation explaining watermark meanings

  4. Monitor and Adjust

    • Collect user feedback on watermark usability
    • Review accessibility complaints and adjust settings
    • Track label application and removal patterns

  5. Test Before Deployment

    • Pilot new watermark configurations with test group
    • Verify compatibility with all document types
    • Test with assistive technologies

For End Users

  1. Understand Label Meanings

    • Learn what each watermark indicates
    • Apply appropriate labels to new documents
    • Don’t remove labels unless authorized

  2. Report Issues

    • Notify IT if watermarks don’t display correctly
    • Report accessibility concerns with diagonal layouts
    • Document any refresh issues with screenshots

  3. Follow Policies

    • Respect label protection settings
    • Don’t attempt to circumvent watermarks
    • Use labels as intended by organizational policy

Automation and Monitoring

# Script to audit watermark configurations
Connect-IPPSSession

# Get all labels with watermarks
$labels = Get-Label | Where-Object { 
    $_.AdvancedSettings.watermarktext -ne $null 
}

# Report on configurations
$report = foreach ($label in $labels) {
    [PSCustomObject]@{
        LabelName = $label.DisplayName
        Layout = $label.AdvancedSettings.watermarklayout
        Text = $label.AdvancedSettings.watermarktext
        FontSize = $label.AdvancedSettings.watermarkfontsize
        Color = $label.AdvancedSettings.watermarkfontcolor
        LastModified = $label.LastModifiedTime
    }
}

# Export to CSV
$report | Export-Csv -Path ".\WatermarkAudit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Display summary
Write-Host "`nWatermark Configuration Summary:" -ForegroundColor Cyan
$report | Format-Table -AutoSize

Conclusion

Sensitivity label watermarks are essential for information protection and compliance, but their configuration requires careful consideration of user experience and accessibility. Horizontal watermark layouts provide better accessibility compliance and user satisfaction compared to diagonal layouts, while still maintaining the visual indicators necessary for data classification.

Key Takeaways:

✅ Choose horizontal layout for better accessibility and user experience
✅ Reserve diagonal layout for highest sensitivity classifications only
✅ Test watermark configurations with diverse user groups
✅ Re-apply labels to force watermark refresh when needed
✅ Allow 24-48 hours for policy changes to fully propagate
✅ Monitor user feedback and adjust configurations accordingly
✅ Ensure compliance with accessibility standards (WCAG, Section 508)

By following these guidelines and best practices, organizations can implement effective sensitivity label watermarks that balance security requirements with usability and accessibility needs.

References