OneDrive: Block screen capture for sensitivity-labeled PDFs in the OneDrive and SharePoint web viewer

🚨 The Signal: OneDrive and SharePoint web viewers now block screen capture for sensitivity-labeled PDFs with 'Do Not Allow Screen Capture' permission. This enhances data loss prevention for sensitive documents viewed in the browser.

The Impact

Users viewing sensitive PDFs in OneDrive/SharePoint web viewer are affected, reducing the risk of unauthorised data exfiltration via screen capture.

• End users: Cannot screenshot sensitive PDFs, potentially disrupting information sharing.
• Security teams: Enhanced data protection for sensitive PDFs, reducing exfiltration risk.
• Compliance officers: Improved adherence to data handling policies and regulatory requirements.
• Data owners: Greater assurance that sensitive information remains protected when viewed online.

The Action

1. Review existing Microsoft Information Protection (MIP) sensitivity labels for PDFs.
2. Ensure 'Do Not Allow Screen Capture' is enabled for labels applied to highly sensitive PDF content.
3. Communicate new screen capture restrictions to end-users who handle sensitive PDFs.
4. Monitor Microsoft Purview audit logs for attempts to bypass data protection controls.

Domain: Purview · Impact: high · Workload: Microsoft Purview