Adobe PDF Watermark and Stamp Confidential Documents

Overview

This flow watermarks confidential documents with Adobe PDF Services. When a document is published to a controlled SharePoint library, the flow stamps a CONFIDENTIAL watermark onto it (via Adobe's addwatermark operation), serves the watermarked copy to an output library, and logs the action to Teams for traceability.

Status: Built (CF-544). Ships Off (reference demo). Going live requires only authorizing the connections and setting env-var values.

Why it matters: Unmarked confidential documents are easy to leak anonymously. A CONFIDENTIAL watermark plus a per-recipient traceability log deters leaks and helps trace any copy back to who received it. Adobe is called via the built-in HTTP action (token -> assets -> PUT -> operation/addwatermark -> poll -> download), so no Adobe connection reference is needed — credentials come from environment variables.

Use Case

Teams sharing sensitive PDFs want every published copy stamped CONFIDENTIAL and logged with the recipient + date so any leaked copy is traceable.

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
SharePoint	shared_sharepointonline	GetOnNewFileItems GetFileContent GetFileContentByPath CreateFile
HHTTP	http	POST /token POST /assets PUT upload POST /operation/addwatermark GET status GET download
Microsoft Teams	shared_teams	PostMessageToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Watermark template

Swap flowlibs_WatermarkTemplatePath for any branded watermark PDF. Adobe addwatermark currently supports only a PDF watermark (not inline text), so the per-recipient/date text is recorded in the Teams log; to render dynamic text on the page, regenerate the watermark template per recipient or generate it on the fly with Adobe HTML-to-PDF / createpdf.

Opacity & placement

Tune flowlibs_WatermarkOpacity (0-100); the request uses appearOnForeground. Add pageRanges to the Compose Watermark Request to limit pages.

Tiered stamps

Branch on document classification metadata to pick different watermark templates (CONFIDENTIAL / INTERNAL / SECRET).

QR trace

Embed a QR code in the watermark template that links to the access log.

Trigger on download

Swap the new-file trigger for a Power Apps / Request trigger to watermark on download instead of on publish.

Persistent audit

Add a Dataverse CreateRecord alongside the Teams log for a queryable access trail.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@endsWith(toLower(triggerOutputs()?['body/{FilenameWithExtension}']), '.pdf')

@concat(variables('varWatermarkText'),' - ',variables('varRecipient'),' - ',formatDateTime(utcNow(),'yyyy-MM-dd'))

client_id=@{variables('varAdobeClientId')}&client_secret=@{variables('varAdobeClientSecret')}

@base64ToBinary(body('Get_Source_Document')?['$content'])

@int(variables('varOpacity'))

@or(equals(variables('varJobStatus'),'done'),equals(variables('varJobStatus'),'failed'))

@body('Get_Watermark_Job_Status')?['asset']?['downloadUri']

@concat(replace(triggerOutputs()?['body/{FilenameWithExtension}'],'.pdf',''),'-CONFIDENTIAL.pdf')

Customize & download