How to Configure Sensitivity Labels, Watermarking, and Meeting Encryption in Microsoft Teams

In highly regulated industries—such as legal counsel, financial auditing, healthcare, and defence contracting—confidential data is frequently discussed and displayed during virtual meetings. Standard collaboration sessions carry significant data leakage risks: unauthorized participants can capture screenshots of proprietary financial projections, take photos of intellectual property via external smartphones, or eavesdrop on unencrypted media streams traversing intermediate relay servers.

Through the integration of Microsoft Purview Information Protection and Microsoft Teams (including Teams Premium), enterprise administrators can enforce stringent meeting safeguards. By combining Sensitivity Labels, dynamic forensic Watermarking, and End-to-End Encryption (E2EE), organisations can prevent data exfiltration and ensure meeting payloads remain cryptographically sealed. This guide details how to architect, configure, and audit these enterprise security controls within Microsoft Teams.

---

Architectural Mechanics: Purview Security Controls in Teams

Security policies in Teams operate across three distinct enforcement planes:

Security Mechanism	Governing Service	Technical Enforcement Layer	Protection Scope
Sensitivity Labels	Microsoft Purview	Azure Rights Management Services (RMS) policy engine	Enforces meeting options (lobby bypass, chat copy prevention, attendee mic/camera locks) declaratively upon scheduling.
Dynamic Watermarking	Teams Media Processor	Client-side GPU shader rendering	Overlays the viewing participant’s User Principal Name (UPN) across shared screens and camera feeds to deter visual leaks.
End-to-End Encryption (E2EE)	Teams Calling Subsystem	Secure Real-time Transport Protocol (SRTP) with peer-negotiated keys	Encrypts audio, video, and screen sharing directly between client endpoints, bypassing Microsoft datacenter decryption.

---

Prerequisites and Licensing Requirements

• Microsoft 365 E5 / Compliance E5 or Microsoft Teams Premium add-on licenses for meeting organizers deploying watermarking and advanced label policies.
• Global Administrator or Compliance Administrator rights in the Microsoft Purview compliance portal.
• Teams Administrator rights in the Microsoft Teams admin centre.

---

Step 1: Creating the Purview Sensitivity Label

Sensitivity labels must be created and published in Purview before they can be bound to Microsoft Teams meetings:

1. Navigate to the Microsoft Purview compliance portal (compliance.microsoft.com).
2. In the left navigation bar, expand Information protection and select Labels.
3. Click + Create a label.
4. Provide a descriptive label name and display label (e.g., Confidential – Executive Strategy).
5. On the Define the scope for this label page, select Meetings alongside Items (Files and emails). Ensure the Include Teams meetings and chat checkbox is checked.

---

Step 2: Configuring Meeting Protection and Watermarking

Proceed through the label creation wizard to the Choose protection settings for Teams meetings and chat stage:

1. Enforcing Meeting Options:

• Who can bypass the lobby: Set to Only organizers and co-organizers or People in my organization to prevent external attendees from entering prematurely.
• Who can present: Set to Specific people or Only organizers.
• Prevent copying chat content: Check Turn off copying or forwarding of meeting chat to block attendees from copying text or extracting chat payloads out of the meeting boundary.

2. Enabling Forensic Dynamic Watermarking:

1. Check the box for Apply watermark.
2. Select Apply watermark to shared content (screens and application windows).
3. Select Apply watermark to everyone’s video feed (camera video tiles).

When an attendee views the meeting, the Teams client renders a semi-transparent, tiled pattern of their own email address across all incoming video streams. If someone photographs their physical display monitor using a smartphone, the resulting leak contains their own identity emblazoned across the content.

---

Step 3: Enabling End-to-End Encryption (E2EE)

For discussions containing trade secrets or classified discussions, enable End-to-End Encryption (E2EE):

1. Configure E2EE Policy in Teams Admin Centre:

1. Navigate to the Microsoft Teams admin centre (admin.teams.microsoft.com).
2. Expand Enhanced encryption policies under Meetings or Voice.
3. Edit the Global (Org-wide default) policy or create a scoped policy for high-security executives.
4. Set End-to-end meeting encryption to Enabled.
5. Set End-to-end call encryption to Enabled.
6. Click Save.

2. Understand E2EE Operational Trade-offs:

Because E2EE bypasses Microsoft 365 cloud media processing servers entirely, certain server-dependent features are automatically disabled during E2EE sessions:

Disabled During E2EE Meetings	Supported During E2EE Meetings
Cloud Recording and Automatic Transcription	Encrypted Audio and 1080p Video
Live Captions and Real-time Translation	Encrypted Screen and Application Sharing
Breakout Rooms	Meeting Chat and Reactions
PSTN Phone Dial-In Attendees	Dynamic Watermarking (Teams Premium)

---

Step 4: Publishing the Label via Label Policy

1. In the Purview compliance portal, select the Label policies tab and click Publish label.
2. Select the newly created sensitivity label.
3. Scope the policy to specific organizational units, executive security groups, or org-wide.
4. Under policy settings, optionally mandate that users must supply a justification when removing or downgrading a label.
5. Name and submit the policy. Allow up to 24 hours for policy replication across Microsoft 365 tenant endpoints.

---

Step 5: Scheduling and Verifying Protected Meetings

Once published, organisers can select the label directly when scheduling meetings in Microsoft Teams or Outlook:

1. Open the Teams Calendar and click New meeting.
2. In the meeting header, locate the Sensitivity drop-down menu and choose Confidential – Executive Strategy.
3. Notice that meeting options (lobby bypass, watermark enforcement, and chat restrictions) lock immediately into compliance.
4. Join the meeting. Confirm that:
   • A small padlock shield icon appears in the top-left status bar indicating the sensitivity label and encryption status.
   • Your personal email address is rendered diagonally across all incoming screen shares and video streams.

---

Troubleshooting Common Meeting Security Faults

Observed Issue	Root Cause	Diagnostic & Remediation Step
Sensitivity label drop-down missing when creating new meeting	Label policy not published to user, or 24-hour Purview replication delay	Verify policy assignment in compliance.microsoft.com under Label policies. Confirm user is assigned a Teams Premium license. Sign out of Teams and sign back in to refresh token cache.
Watermark does not display on specific attendee screens	Attendee joining from outdated web browser, third-party VDI thin client, or legacy Teams classic app	Dynamic watermarking requires the modern Microsoft Teams client (version 2.0+ on Windows/macOS) or Edge/Chrome browser. Advise attendees to update their client binary.
E2EE toggle fails to activate when scheduling meeting	Conflicting meeting options enabled (e.g., Automatic Recording or Breakout Rooms enabled)	E2EE cannot coexist with cloud recording. In meeting options, ensure Record automatically is toggled to Off and meeting capacity does not exceed 200 participants.
External guests cannot join the watermarked meeting	Guest tenant configuration or B2B cross-tenant access policy restricting RMS decryption	Check Azure Active Directory External Identities > Cross-tenant access settings. Ensure inbound trust for external organizations is permitted for Purview RMS.

---

Operational Governance and Best Practices

• Target Watermarking Exclusively to High-Impact Labels: Do not enforce watermarks on company-wide all-hands meetings. Watermark shader rendering increases client GPU/CPU load on older laptops; reserve it strictly for confidential financial, HR, and R&D reviews.
• Communicate E2EE Limitations in Meeting Invites: Since cloud recordings and live transcripts are unavailable in E2EE meetings, designate a human note-taker in advance so attendees have meeting minutes.
• Audit Meeting Security Events via Unified Audit Log (UAL): Monitor compliance violations using Microsoft Purview Audit. Filter by TeamsMeetingStartedWithSensitivityLabel and SensitivityLabelApplied to verify adherence across enterprise executive leadership.