Add watermarks when files are opened or downloaded in SharePoint Online / Office 365

Posted at: 17:45 on 17 December 2015 by Muhimbi

confidentialOne of the more popular features of the on-premise version of the Muhimbi PDF Converter for SharePoint is the ability to add watermarks – including meta-data, ip-address, date/time information and user information – the moment a file is downloaded or opened. The file as it is sits in SharePoint remains untouched, but the file that is downloaded to the user includes the watermarks. At the same time the PDF file can be secured and encrypted to make sure the watermarks cannot be touched. For details about how this works for the on-premise version – largely identical to the online product – see this blog post.

Brilliant feature, quite often used for security / DRM-light purposes, but up until now only available for SharePoint On-Premises as providing this functionality in SharePoint Online – which is a very restricted platform – has proven to be….well…..tricky.

Well, that ends today as we are happy to announce the general availability of this functionality for the PDF Converter for SharePoint Online. Read on for details about how it works and how to enable it.

Update September 2020: This functionality is no longer limited to just PDF files, it also works with MS-Word, Excel and PowerPoint documents. For details see this blog post.


How it works

Before we go into further detail, let’s agree on a short name for this Feature as ‘Real Time Watermarking & Security when a file is accessed’ doesn’t roll off the tongue. Internally our team calls it ‘OnOpen’ as in something happens when a file is opened. So OnOpen it is, at least for the remainder of this post.

Once OnOpen is enabled (see the end of this post for details), whenever a PDF file is downloaded our software automatically adds any configured watermarks and security settings while the file is being sent to the user. It is up to the Site Administrators and List Owners to define these settings.

When OnOpen is first enabled on a site collection the settings are restricted by default. Site Collection Administrators will need to navigate to Site Settings / PDF Watermarking Settings (and/or PDF Security Settings) to specify the default settings and optionally specify if List Owners can override these settings.


PDF Watermarking settings screen as opened from Site Settings.

Please note that by simply specifying this information at the Site Settings level, watermarks are NOT automatically enabled in the Site Collection’s Lists and Libraries. Although the default settings can be inherited from the Site Settings, it must be enabled on each Library or List manually and individually.

If there is no need to centrally control the content of the watermark and security settings then make sure the Allow overriding option is enabled. This makes it possible for the details to be specified manually on each list or library.

To either manually specify the settings at the List or Library level, or activate the centrally specified settings, navigate to the relevant list or library, and from the List / Library ribbon tab select Library Settings / List Settings. This screen contains two new entries,  PDF Watermarking Settings and PDF Security Settings, clicking the former shows the following screen.

PDF Watermarking settings screen as opened from Library Settings


This screen provides the option to inherit the centrally specified settings, or – if permitted – manually specify settings and an optional filter.

By default watermarks are applied for every PDF file that is opened, but by specifying a filter it is possible to narrow it down based on a file’s meta-data, which can be very powerful. E.g. apply a ‘DRAFT’ watermark when the document status is set as such and skip the watermark if the status is ‘Final’.

Although adding static watermarks that don’t change over time can be very useful, the same can be achieved using our workflow facilities that only apply the watermark once rather than every time the document is opened. The real power of the OnOpen facility comes from the ability to insert Meta-Data or Macros in a watermark. This allows such scenarios as:

  • Apply a watermark showing when the document was opened from SharePoint.
       Opened on '{LONG_DATE} / {LONG_TIME}' 
  • Include the name, login id and ip-number of the user who downloaded the document, a great security feature if a document shows up in a place it is not supposed to show up.
      Opened by '{LOGON_USER}' ({USER_NAME}) on '{LONG_DATE} / {LONG_TIME}' from IP '{REMOTE_ADDR}'
  • Include the Title, file name and last modified date in a document.
      Title: {Title}, File: {FileLeafRef}, Modified: {Modified}
  • Add hidden watermarks to a document. E.g. fully transparent text that is invisible to the user, but can be extracted at a later date in case a document is leaked or shared with an unauthorised party.
  • A mix of any of the above or any of the other meta-data fields and macros. A full list of Field codes and Macros can be found in this Knowledge Base article.


Finally, it is not just about watermarking as anyone with basic ‘Google search’ skills can download a simple PDF editor. To prevent users from modifying watermarks, and add additional layers of security by locking down printing and content copying, a Secure OnOpen facility is available as well.

Secure-OnOpen-ListSettingsApply Security when a file is opened

The concept is the same. Defaults can be specified at the Site Collection level, individual settings can then be enabled at the List or Library levels. Separate filters can be specified if needed. The available security settings are as follows:

  • Open Password: The user accessing the PDF file must know a specific password to open it.
  • Owner password: No password is needed to view the content, but all content is encrypted and any specified security options are locked down.
  • Security Options: Specify which option to lock down. The most popular ones are ‘Disable Printing’ and ‘Disable Content Copying’.


What happens when a document cannot be processed?

Although this facility is built upon an established and resilient platform, there are situations where a document cannot be processed. For example if the PDF is corrupt, already encrypted or the subscription has run out of monthly operations. It is important to decide up-front what to do in cases like this.


How the system deals with problematic situations can be configured using the PDF real-time settings link under Site Settings. The options are as follows:

  1. Show the original, unprocessed, document: For situations where watermarking or PDF security is a nice-to-have, but no show-stopper, you may want to choose this option, which will return the original document as if the OnOpen facility is not active at all.
  2. Block access to the original document: This option, which is the default, blocks access to the document if it cannot be processed. This is generally used in situations where the document MUST be processed before it is sent out, no exceptions.


How to enable

So, all in all a pretty cool feature, however it must be enabled by a Site Collection Administrator before it can be used. For details about how to do this see this Knowledge Base Article. Don’t forget to enable the Automatic PDF Processing App Feature after elevating the privileges, both steps are described in detail in the article.

Please note that extra installation steps are required when using this functionality in a List or Library utilising the Modern Experience. Details can be found in this Knowledge Base article.


Any questions or feedback? Have a look at the FAQ, leave a comment below or contact our friendly support desk.


Labels: , , , ,


  • Can you add watermark for Microsoft office documents?

    By Anonymous Karen, At 02 February, 2016 00:48  

  • Hi Karen,

    We can only add watermarks to PDF files at this moment in time.

    If you have any other questions please contact, they love to help.

    By Blogger Muhimbi, At 02 February, 2016 08:25  

  • Will this watermark existing pdfs? As in pdfs that were not created through your software?

    By Blogger Ruby, At 12 February, 2016 17:26  

  • Hi Ruby,

    That will indeed work on existing PDFs unless the PDFs are encrypted or secured with an 'Open password'.

    Why don't you give it a try? You can download the App from the SharePoint App store. For details see

    If you have any questions then please contact

    By Blogger Muhimbi, At 12 February, 2016 17:29  

  • Awesome, I shall give it a try. Thanks!

    By Blogger Ruby, At 12 February, 2016 20:02  

  • Hi,

    Can the watermark be removed by using Office or PDF editor application?

    Best Regards,
    Chokchai L,

    By Blogger Unknown, At 08 August, 2016 09:31  

  • Hi Chokchai,

    At the same time as applying the watermark you can also choose to encrypt it, which make it impossible to remove it using PDF Editor applications.

    If you have any specific questions then please reach out to our friendly support desk at

    By Blogger Muhimbi, At 08 August, 2016 09:35  

  • We are currently in SP2013 but will be migrating to SP Online in the not too distant future. Can your tool be used in both environments?

    By Anonymous Anonymous, At 13 January, 2017 19:05  

  • Absolutely, but please keep in mind that deployment is quite different as SharePoint Online Apps are typically deployed from the App Store and don't require comprehensive server side preparation. Have a look at or reach out to, we are here to help.

    By Blogger Muhimbi, At 13 January, 2017 19:15  

  • What is the install & setup like for Sharepoiont2013 servers?
    Can you tell me some more info about the 'Owner Password'?
    We are curious to see if it's possible to use your software to lock PDFs requiring users to enter their existing Sharepoint credentials/password to open the dynamically watermarked PDF on download/open.

    By Blogger jamierooney, At 20 June, 2017 11:28  

  • Hi Jamie,

    Although I'd advise you to use for questions like this, the steps on SP2013 are as follows:

    1. Download the SP2013 version of our software from

    2. Install it in line with Chapter 2 of the included Admin Guide (if you are only interested in watermarking and security, and not Office Conversion, then there is no need to install the Office dependencies)

    3. Configure real-time watermarking & security as per

    It is not possible to secure the PDF with the user's existing username / password unless you have those login details stored somewhere.

    Owner password is the password specified to enforce PDF Security settings (prevent print, content copy etc).

    By Blogger Muhimbi, At 20 June, 2017 11:39  

  • We need to generate PDF from uploaded Office Document (*.docx, *.xslx, *.pptx) in document library, and also create custom watermark in generated file. Is this product can handle our requirements? If not, do you have any other solution/product ?

    By Blogger Syahri Ramadhan, At 27 June, 2017 16:24  

  • Hi Syahri,

    That is exactly what our software does. Are you looking to do this in SharePoint Online or SharePoint on-premise?

    Please drop a line for details.

    By Blogger Muhimbi, At 27 June, 2017 16:29  

  • I dont see the watermark when pdf opens in the browser (google chrome browser)

    By Blogger Unknown, At 11 December, 2018 01:25  

  • If you don't see the watermark then it is most likely hidden behind an opaque background. Have a look at this Knowledge Base article, or contact

    By Blogger Muhimbi, At 11 December, 2018 09:41  

  • Can you watermark document with IRM enabled?

    By Anonymous Anonymous, At 11 June, 2020 18:33  

  • Unfortunately it is not possible to alter IRM enabled documents. This is by design as IRM does not allow access by third parties.

    For detail and a possible workaround, see

    By Blogger Muhimbi, At 12 June, 2020 09:18  

Post a Comment

Subscribe to Post Comments [Atom]

Subscribe to News feed