'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Allow Editing but Prevent File Downloads in SharePoint 2016
Question details
The user needs to configure a SharePoint Server 2016 folder to allow users to view and edit files while strictly preventing them from downloading copies of the sensitive data.
- Product
- SharePoint Server 2016
- Device & OS
- not provided
- Scenario
- Securing sensitive enterprise data in a shared folder while maintaining collaborative editing capabilities.
- Observed behavior
- Users are still able to download copies of the files even after disabling inheritance and assigning a custom permission level to a test account.
Verify that you have Farm Administrator or Site Collection Administrator privileges in SharePoint 2016, as advanced permission controls or Information Rights Management (IRM) configuration require elevated access.
Utilize Information Rights Management (IRM)
Because standard custom permission levels often bundle client-side editing with download capabilities, IRM is the Microsoft-recommended method to encrypt and restrict file downloads while allowing editing.
In SharePoint Server 2016, standard permission configurations struggle to separate 'Edit' from 'Download' because traditional client-side editing inherently requires a temporary local cache. Information Rights Management (IRM) solves this by enforcing restrictions at the document level.
Note that IRM for SharePoint Server 2016 typically requires an Active Directory Rights Management Services (AD RMS) infrastructure to be deployed.
Log in to SharePoint Central Administration, go to Security, and configure Information Rights Management to point to your AD RMS server.
Navigate to the specific SharePoint Document Library containing the sensitive data. Click the 'Library' tab in the ribbon and select 'Library Settings'.
Under 'Permissions and Management', click 'Information Rights Management'. Check the box to 'Restrict permission to documents in this library on download'.
Set a policy title and configure the options to prevent users from printing, running scripts, or saving copies locally while they interact with the document.
Consult SharePoint Server Management Specialists
If IRM is not an option for your environment, complex XML-based custom permission configurations for on-premises servers are best handled by Microsoft Server specialists.
Looking for an Easier Way to Securely Collaborate? Try WPS Office
Managing complex server permissions and AD RMS in SharePoint can be daunting and expensive. WPS Office offers a lightweight, highly compatible alternative with built-in cloud collaboration. Easily share files with precise granular permissions—allowing editing while seamlessly blocking downloads—without complex server setups.
- 1. Download and Install: Get WPS Office for your PC or mobile device and create a free account to access WPS Cloud.
- 2. Upload Your Document: Save your sensitive document to your WPS Cloud drive to enable advanced sharing controls.
- 3. Share with Restrictions: Click 'Share', generate a collaboration link, and explicitly toggle off the 'Allow Download' or 'Allow Print' options while keeping editing enabled.
Frequently Asked Questions
Why does the 'Edit' permission automatically allow downloading in SharePoint 2016?
In SharePoint Server 2016, editing a file typically requires the file to be opened in a desktop client application (like Microsoft Word or Excel). To do this, the system inherently downloads a temporary copy to the user's local Office cache. Standard SharePoint permissions cannot easily separate client-side editing from downloading.
Can I prevent downloads if I use Office Online Server (OOS)?
Yes. If your SharePoint 2016 environment is integrated with Office Online Server (OOS), users can edit documents directly in the browser. You can configure permission levels to force browser-only interaction, which helps mitigate direct local downloads, though Information Rights Management (IRM) is still the most secure method.
Does Information Rights Management (IRM) require additional server licensing?
Yes, utilizing IRM for SharePoint Server 2016 on-premises requires an Active Directory Rights Management Services (AD RMS) server to be deployed and configured on your network. This may involve additional Windows Server licensing considerations depending on your enterprise setup.
