'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Prevent SharePoint Read-Only Users from Editing Excel Attachments
Question details
A SharePoint user assigned 'Read' permissions can open, edit, and save changes to Excel attachments via the desktop application, despite the file being strictly read-only in the web browser.
- Product
- Microsoft SharePoint and Excel
- Device & OS
- not provided
- Scenario
- Managing document security and enforcing read-only access for users downloading or opening Excel attachments from SharePoint.
- Observed behavior
- The browser correctly enforces read-only mode online, but when the file is opened in desktop Excel, the user can remove the read-only restriction, modify the file, and save changes back to the server.
Verify the exact permission level assigned to the affected user in the SharePoint site or specific list, and confirm whether they have 'Edit' or 'Contribute' permissions inherited from another SharePoint group.
Contact Microsoft 365 Support for Service Investigation
Since this involves tenant permissions and service behavior discrepancies between browser and desktop apps, Microsoft Support needs to investigate the backend logs.
Microsoft SharePoint and Office desktop applications sometimes enforce permissions differently. Read permission alone in a SharePoint list may not guarantee that every desktop editing scenario is blocked due to how the desktop sync app or Office client authenticates and handles attachments. Because there is no straightforward toggle to prevent this while still allowing desktop access, escalating to a tenant admin is necessary.
Log into the Microsoft 365 Admin Center with administrator credentials.
Navigate to 'Support' > 'Help & support' to open a new service request.
Provide detailed reproduction steps, the specific user account details, and note that the file is read-only online but fully editable in the desktop app.
Work with the Microsoft 365 support team to gather relevant SharePoint permission and service logs for your tenant.
Test Permissions with a Controlled File and User
Isolate the issue to determine if it affects a single user, a specific file, or the entire tenant.
Looking for a simpler way to manage your spreadsheets securely?
If managing complex Microsoft Office permissions and syncing issues becomes overwhelming, consider WPS Office. It provides a lightweight, highly compatible alternative for handling your daily spreadsheet tasks with simple, reliable built-in document protection features.
- 1. Open WPS Spreadsheet: Launch WPS Office and open your spreadsheet document.
- 2. Access Protection Features: Navigate to the 'Review' tab on the top ribbon and click on 'Protect Sheet' or 'Protect Workbook'.
- 3. Set a Read-Only Password: Enter a secure password to prevent unauthorized users from making local edits to your document.
Frequently Asked Questions
Why does SharePoint allow read-only users to edit in the Excel desktop app?
This often occurs due to discrepancies in how the browser and desktop applications authenticate and enforce permissions. Desktop applications sometimes cache credentials or recognize higher inherited permission levels (like Edit or Contribute) from the site level, bypassing the specific list's Read-only setting.
How can I block users from opening SharePoint files in the desktop app completely?
You can force documents to open strictly in the browser by going to the SharePoint Document Library Settings > Advanced Settings. Under the 'Opening Documents in the Browser' section, select the 'Open in the browser' option.
Does a 'View Only' permission prevent downloading and desktop editing?
Yes. While 'Read' permissions generally allow users to download files, assigning a 'View Only' permission prevents users from downloading the document entirely. If they cannot download it, they cannot open it in the desktop client to bypass browser read-only restrictions.
