'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Create SharePoint Permissions to Block File Downloads
Question details
The user wants to configure custom permission levels in SharePoint Online to restrict users from downloading files while still allowing browser-only viewing or editing.
- Product
- SharePoint Online
- Device & OS
- not provided
- Scenario
- Restricting document access to browser-only viewing or editing to enhance data security and prevent unauthorized file downloads.
- Observed behavior
- Users require a setup where files cannot be downloaded locally, opened in desktop apps, copied, or printed, but can still be read or edited online depending on their specific roles.
Ensure you have Site Administrator privileges in SharePoint Online, as this is required to create and manage custom permission levels for your site.
Configure Custom Permission Levels Without Download Rights
Create new custom permission levels by copying the default Read or Contribute permissions and removing the specific rights that allow downloading or opening files in desktop apps.
By default, SharePoint's standard 'Read' and 'Contribute' permission levels allow users to download files. To prevent this while retaining web-based access, you must create customized versions of these permission levels.
Click the gear icon in the top right corner of your SharePoint site, select 'Site permissions', and then click 'Advanced permissions settings'.
In the Permissions ribbon, click on 'Permission Levels' to view all available roles in your site.
Click on the 'Read' or 'Contribute' permission level. Scroll to the bottom of the page and click 'Copy Permission Level'.
Name the new permission level (e.g., 'Read without Download' or 'Contribute without Download'). Under the List Permissions section, uncheck 'Open Items - View the source of documents with server-side file handlers' to disable downloading and desktop app access.
Click 'Create' to save the custom permission level. You can now assign this new role to specific users or groups to enforce browser-only viewing or editing.
Try WPS Office for Secure Document Collaboration
While SharePoint handles Microsoft 365 environment permissions, if you are looking for a highly compatible, lightweight, and cost-effective office suite for offline and online document editing, WPS Office provides excellent tools for everyday work.
- 1. Visit the Official Website: Go to the official WPS Office website to download the latest free version.
- 2. Install the Software: Run the installer and follow the on-screen instructions to complete the setup.
- 3. Open and Edit Seamlessly: Launch WPS Office and instantly open your existing Word, Excel, and PowerPoint files without formatting issues.
Frequently Asked Questions
Does 'Read without Download' block printing in SharePoint?
Standard custom permissions cannot completely block a user from printing a document from their browser. To strictly enforce a no-printing policy, you must enable Information Rights Management (IRM) on the document library.
Can users still edit documents if SharePoint downloads are blocked?
Yes. If you create a 'Contribute without Download' permission level, users can edit documents directly in the web browser via Office Online without being able to download or open them in the local desktop application.
Why can users still open files in the desktop app after I changed the permissions?
Make sure you have specifically unchecked the 'Open Items' option in your custom permission level settings. This specific setting controls the ability to view the document source and open files in local client applications.
