A colleague sends you a video that appears polished and credible and makes several bold claims. However, something seems unusual: was it created by a person or generated by a machine?

That is the question Microsoft 365 aims to address. The company is introducing watermarks to help users tell the difference.

Although many people may not know about this feature yet, it is worth noting.

What Microsoft Actually Did

Microsoft added a setting called Cloud Policy. It’s not exciting. It’s practical.

Turn it on and videos made by AI get a visible watermark. Copilot-generated videos. AI-edited footage. All marked. Audio made by AI gets an audible watermark. Copilot audio summaries pulled from your Word documents. All of it flagged.

Two things matter here. First, only admins control it. Your users can’t flip it on or off themselves. If you want watermarks, you set them up.

If you don’t want them, you turn them off. Second, and this is important, turning the visible watermark off doesn’t erase the tracking data. Microsoft still adds information to the file itself. The human-visible mark disappears. The digital record remains.

This is where most organisations get confused. They turn off the visible watermark thinking they’ve solved the problem. They haven’t. The metadata is still there, still tracking where the content came from, still creating an audit trail.

The Invisible Part Matters More

Everyone sees the watermark if it’s there. The metadata is what matters.

Microsoft uses C2PA. That’s Coalition for Content Provenance and Authenticity. Sounds like jargon, but it’s straightforward records of where something came from. Which AI model generated it. Which application created the file. What time it happened.

This metadata is cryptographically signed. Translation: it’s locked in place. You can’t edit it without breaking the signature. If someone tampers with it, the system knows.

Right now, this works best for images. Video and audio support is supposedly coming, but it’s not complete yet. The honest thing is to check what your own Microsoft 365 tenant does before you start assuming everything is watermarked.

Why This Matters (Beyond Marketing)

Most people assume this is marketing stuff. It’s not.

If your organisation publishes council briefings, training videos, volunteer guides, or anything that reaches outside your building—and AI touched it—being able to say so clearly matters. You’re being honest with people. You’re building trust.

That sounds abstract until you think about actual examples. A local government agency publishes a resident briefing video. AI helped create it. You can watermark it. Residents know what they’re watching was machine-generated. Trust doesn’t disappear. It actually increases because you were honest about it.

A charity creates training material for volunteers. AI wrote parts of it. You mark it. Volunteers understand the content they’re learning from. Transparency builds confidence faster than trying to hide where things come from.

Regulators are pushing this direction anyway. The EU AI Act has actual rules about disclosing AI usage. Governments are demanding this. Vendors are building it because they have to.

What Actually Doesn’t Work

Let’s be honest about the limitations. This isn’t magic.

Metadata is easily lost. Crop a video, and it’s gone. Screenshot an image, and it’s gone. Re-encode a file, and it’s gone. So treat watermarks as a helpful signal, not proof of anything. They’re there until someone manipulates the file. Then they’re gone.

The metadata also doesn’t prove something is true. An AI-generated file can have perfect watermarking and still say something completely wrong.

Provenance tells you where something came from. It says nothing about whether it’s accurate. A machine can generate perfectly watermarked lies as easily as truths.

There’s also a privacy wrinkle. Images made with some Microsoft AI tools carry identifiers tracing back to whoever created them. If you share an AI-generated image outside your organisation, that metadata could leak internal information about who made it.

That’s not ideal when you’re sharing content with external partners or the public. The file carries metadata you might not want distributed.

What Admins Actually Need To Do

You don’t need a massive project. Just some actual thinking.

First, check the Cloud Policy setting. You’ll find it in your admin centre. Decide whether you want visible watermarks on or off. Think about your specific situation.

Are you creating content that leaves the building? Are you publishing to the public? For internal use only? The answer changes what you should do.

Second, review what your teams are generating. Especially video and audio. If teams are creating Copilot videos or AI audio summaries that leave your organisation, watermarking matters. If it’s internal analysis nobody shares externally, less critical.

Third, update your AI usage policy. Make sure staff understand that generated content might carry metadata. If they create and share AI content, they should know provenance information is being tracked.

Fourth, think about privacy before sharing AI-generated files externally. That metadata travels with the file. Understand what information you’re sharing before it goes outside.

Fifth, come back to this in a few months. This area moves fast. Capabilities change. Best practices shift. What’s right today might not be right in six months.

Pair that with the broader data protection work, and you get the full picture. Our guides on EU Data Boundary and Copilot and OpenAI as a subprocessor cover more ground.

Conclusion

Watermarking won’t stop misinformation. It was never designed to. What it does is add transparency. People can see if something was AI-made. That matters increasingly as AI content becomes harder to distinguish from human-generated content.

Using watermarking alone is pointless. Combine it with actual governance. Clear policies about how AI gets used. Sensible data protection rules. That combination strengthens trust.

We help organisations set up their Microsoft 365 AI settings properly. Governance. Compliance. Data protection.

Book a free assessment, and we’ll show you how to set it up the way your organisation needs it, not the way vendors want to sell it.

FAQs

What is AI watermarking in Microsoft 365?

AI watermarking identifies content created or modified using AI. Depending on the content type, it can add visible marks to AI-generated videos and audible signals to AI-generated audio.

Is it on by default?

No. AI watermarking is controlled by Microsoft 365 administrators and is not automatically enabled for everyone. Admins can manage the setting based on their organisation’s requirements. Individual users cannot turn the feature on or off themselves.

What is C2PA?

C2PA stands for Coalition for Content Provenance and Authenticity. It is an industry standard designed to record where digital content came from and how it was created or changed. The metadata can include details such as the AI model or application used, the creation time, and other provenance information.

Can you remove watermarks?

The metadata is not guaranteed to survive every type of editing. Actions such as taking a screenshot, cropping, exporting, or re-encoding content can remove or alter the associated metadata.

Does it watermark written text?

There is currently no confirmation that this watermarking approach adds a visible or invisible mark to ordinary written documents.