Published: 3 August 2026. Source: Microsoft Learn: Enable sensitivity labels for Office files in SharePoint and OneDrive
Over 60 percent of Microsoft 365 tenants have at least one sensitivity label published, yet most enforcement stops at preventing external sharing or requiring encryption. Starting mid-August 2026, a layer of protection many admins configured but never saw enforced in the browser finally activates: Microsoft Edge will block screen captures of PDFs carrying a sensitivity label set with Do Not Allow Screen Capture.
What is changing?
Microsoft Edge's built-in PDF viewer is gaining enforcement of the Do Not Allow Screen Capture protection option from Microsoft Purview Information Protection. When a user opens a labelled PDF from SharePoint Online or OneDrive for Business and that label's protection template includes screen-capture blocking, Edge prevents Windows screenshot APIs from capturing the page content. The file remains visible in the browser; an OS-level capture tool returns a blank or blacked-out frame instead of the document.
Rollout runs from mid-August through late August 2026. Admins don't need to take any action for the browser enforcement itself - the only prerequisite is a qualifying sensitivity label with Do Not Allow Screen Capture already applied to the PDF.
Which files and scenarios are affected?
| Scenario | Screen-capture behaviour after rollout |
|---|---|
| PDF in SharePoint with a label that includes Do Not Allow Screen Capture | Blocked in Microsoft Edge's PDF viewer |
| PDF in OneDrive for Business with the same label type | Blocked in Microsoft Edge's PDF viewer |
| PDF without any sensitivity label | No change; capture works as before |
| PDF with a sensitivity label that does not include screen-capture blocking | No change; capture works as before |
| Same PDF opened in a third-party browser with its own PDF renderer | Not guaranteed to enforce at rollout; depends on the browser |
| Word or Excel files with equivalent labels | Not part of this specific rollout; different enforcement path applies |
Why this matters for SharePoint admins
Sensitivity labels in SharePoint Online have historically controlled what happens to a file when it leaves the library: blocking downloads, applying encryption, preventing external sharing. This change extends protection to a moment the file stays inside the browser. A contractor who cannot download a document could previously still photograph or screenshot the screen. The Edge enforcement closes that gap for the PDF format.
For admins in regulated industries, the practical question is whether any published label policy already has the Do Not Allow Screen Capture option enabled. If it does, the behaviour activates automatically for any matching PDF in SharePoint or OneDrive. If it does not, this rollout has no visible effect today but signals that Microsoft is building in-browser DRM enforcement incrementally across the Microsoft 365 stack.
This enforcement applies only while the PDF is open in Edge's built-in viewer. A user who downloads the PDF first (if the label policy permits it) works with the file outside the browser context, where separate protections apply. Restricting the download itself requires a distinct label setting.
Admin checks before rollout reaches your tenant
In the Microsoft Purview compliance portal, check three things:
- Review published sensitivity labels. Check which label policies include the Do Not Allow Screen Capture option. Purview's label editor shows protection settings under each label's configuration.
- Confirm SharePoint and OneDrive labelling is enabled. Sensitivity labels for SharePoint Online and OneDrive files must be explicitly activated in the Purview compliance portal. They are not on by default for every tenant.
- Validate your endpoint browser policy. If Edge is not enforced as the required browser through Microsoft Intune or Group Policy, users on other browsers will not see the same restriction.
If your organisation has not yet enabled sensitivity labels for SharePoint Online files, this rollout is a useful prompt to revisit that decision. ShareMaster's Report Master can export a full permissions matrix for any library, showing who currently holds download access before you layer in label-based restrictions. For a broader permissions picture across all sites, the ShareMaster permissions audit guide covers the steps from initial report through to remediation.
Source: Microsoft Learn: Enable sensitivity labels for Office files in SharePoint and OneDrive. Rollout timeline: Microsoft 365 admin centre message centre, August 2026.
Frequently Asked Questions
Will all PDFs stored in SharePoint be affected by this change?
No. Only PDFs with a Microsoft Purview sensitivity label that includes the Do Not Allow Screen Capture protection option are affected. Unlabelled PDFs and PDFs with labels that omit that option behave exactly as before.
Does the screen capture restriction work in browsers other than Microsoft Edge?
At rollout, enforcement is specific to Microsoft Edge's built-in PDF viewer. Other browsers that render PDFs with their own engines may not honour the same restriction. Admins relying on this as a compliance boundary should verify behaviour across the browsers their users actually run.
Do I need to configure anything in SharePoint for this to take effect?
The Edge enforcement is automatic for qualifying PDFs. The only prerequisite is a sensitivity label with Do Not Allow Screen Capture already applied to the file. Admins without such a label policy published will see no change in user behaviour.