How to Configure Teams Meeting Watermark Policies in PowerShell Using CsTeamsMeetingPolicy

Protecting confidential business presentations, unreleased product roadmaps, legal negotiations, and sensitive intellectual property discussed during virtual conferences is a paramount cybersecurity objective. Despite strict non-disclosure agreements, meetings remain vulnerable to unauthorized screen captures, smartphone photos, and unauthorized screen recording software operated by attendees. To deter visual leaks and establish accountability, Microsoft Teams provides native watermarking capabilities. When enabled, Teams stamps each attendee’s corporate email address and User Principal Name (UPN) across shared presentation content and participant camera feeds. Using the Microsoft Teams PowerShell module, administrators can configure watermark policies via CsTeamsMeetingPolicy to enforce targeted or organization-wide protection.

Architecture of Meeting Watermarking in Microsoft Teams

Watermarking in Microsoft Teams operates dynamically on the client rendering canvas. Rather than applying a single static watermark server-side, Teams renders a personalised, tiled, semi-transparent watermark pattern containing the viewing attendee’s unique email address across the video canvas. Because each attendee sees their own identity stamped across the content, any captured image or video snippet immediately identifies the source of the leak.

Under CsTeamsMeetingPolicy, watermarking is governed across two discrete dimensions:

• AllowWatermarkForScreenSharing: Controls whether the organizer can enforce watermarking across shared desktop screens, application windows, and PowerPoint Live presentations.
• AllowWatermarkForCameraVideo: Controls whether watermarks are stamped across participant camera feeds and spotlighted video tiles.

Watermark enforcement requires Microsoft Teams Premium licensing for meeting organizers. When an organizer assigned an enabled watermark policy creates a meeting, the watermark can be enforced by default or toggled per meeting in Meeting Options. Additionally, when watermarking is active, Teams automatically disables client-side cloud recording and certain third-party recording hooks to prevent watermark bypass.

Connecting to the Microsoft Teams PowerShell Module

To inspect and update meeting policies, launch an elevated PowerShell window and import the MicrosoftTeams module. Authenticate with an account assigned the Teams Administrator or Global Administrator role:

Import-Module MicrosoftTeams
Connect-MicrosoftTeams

Confirm the administrative session context by checking your tenant identity:

Get-CsTenant | Select-Object DisplayName, TenantId

Auditing Existing Watermark Policies

Before implementing configuration changes, audit the current state of watermark settings in the default Global (Org-wide) meeting policy:

Get-CsTeamsMeetingPolicy -Identity Global | Select-Object Identity, AllowWatermarkForScreenSharing, AllowWatermarkForCameraVideo

To inspect all meeting policies defined across your tenant and compare their watermark parameters side by side, run:

Get-CsTeamsMeetingPolicy | Select-Object Identity, Description, AllowWatermarkForScreenSharing, AllowWatermarkForCameraVideo | Format-Table -AutoSize

In standard baseline tenants, watermark attributes default to False until explicitly enabled by an administrator.

Enabling Meeting Watermarking Globally

In high-security enterprises where all meeting presentations must be protected against unauthorized distribution by default, administrators can enable watermarking across the Global policy:

Set-CsTeamsMeetingPolicy -Identity Global `
    -AllowWatermarkForScreenSharing $true `
    -AllowWatermarkForCameraVideo $true

Verify that the Global policy reflects the updated configuration:

Get-CsTeamsMeetingPolicy -Identity Global | Select-Object Identity, AllowWatermarkForScreenSharing, AllowWatermarkForCameraVideo

When set to $true, organizers subject to this policy can enable watermarks when scheduling meetings via Outlook or the Teams calendar.

Creating Scoped Watermark Policies for High-Risk Departments

Because watermarks can slightly obscure fine text in standard documents and increase client GPU rendering load, best practice often dictates targeting watermarking specifically to high-risk groups—such as Legal, Corporate Development, R&D, and Executive Leadership.

To create a custom policy with comprehensive screen and camera watermarking enabled:

New-CsTeamsMeetingPolicy -Identity "ConfidentialExecutiveMeetingPolicy" `
    -Description "Enforces screen and camera watermarking for executive IP and legal strategy calls" `
    -AllowWatermarkForScreenSharing $true `
    -AllowWatermarkForCameraVideo $true

If your organization only requires watermarking on shared presentation content but wishes to leave webcam feeds unobscured, configure the parameters selectively:

New-CsTeamsMeetingPolicy -Identity "PresentationsOnlyWatermarkPolicy" `
    -Description "Applies watermarks strictly to shared presentations while leaving camera feeds clear" `
    -AllowWatermarkForScreenSharing $true `
    -AllowWatermarkForCameraVideo $false

Assigning Watermark Policies to Users and Security Groups

To apply a custom watermark meeting policy to an individual organizer, execute Grant-CsTeamsMeetingPolicy:

Grant-CsTeamsMeetingPolicy -Identity "[email protected]" -PolicyName "ConfidentialExecutiveMeetingPolicy"

To assign the policy across an entire department dynamically using a Microsoft Entra ID (Azure AD) security group, execute:

$Group = Get-AzureADGroup -SearchString "Corporate Legal Department"
New-CsGroupPolicyAssignment -GroupId $Group.ObjectId `
    -PolicyType TeamsMeetingPolicy `
    -PolicyName "ConfidentialExecutiveMeetingPolicy" `
    -Rank 1

Group policy assignment rankings resolve policy conflicts when users belong to multiple overlapping security groups.

Verifying Policy Assignments and Client Prerequisites

To verify that a specific user has inherited the designated meeting policy, query their effective policy assignments:

Get-CsUserPolicyAssignment -Identity "[email protected]" -PolicyType TeamsMeetingPolicy

Policy updates typically require between 15 minutes and several hours to propagate across Microsoft 365 cloud services. When an organizer schedules a meeting with watermarking active, ensure attendees meet the client requirements:

• Supported Clients: Watermarking is supported on the Teams desktop client (Windows and macOS), Teams mobile (iOS and Android), and Teams on the web (Edge and Chrome).
• Unsupported Endpoints: If an external attendee attempts to join from an unsupported legacy client or third-party dial-in terminal that cannot render the client-side watermark canvas, Teams blocks entry to prevent un-watermarked content leakage.
• Recording Interaction: When watermarking is active on screen sharing, Teams automatically disables the native “Start recording” button, ensuring that unprotected video files cannot be generated.