Edit Sharepoint Excel file online only but prevent user from downloading personal copy

al4629740
al4629740 used Ask the Experts™
on
I am trying to do something which I'm not sure is possible.  I have an Excel sheet loaded up to our Office 365 SharePoint.  The idea is to share that excel file in a folder where certain users CAN edit the file but CAN'T download a personal copy of the excel file.  This seems relatively simple, but apparently isn't.  Is it possible to have an edit permission which prevents downloading the file?  If so....how?  OR...is there another way to implement what I'm trying to achieve?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Christina WheelerSolution Architect

Commented:
Yes this can be accomplished through Azure AD Conditional Access - Policies but it does require Azure AD Premium P1. You can setup policies to block specific users from being able to download. I used a test account to test the policy I created and it does block them from downloading a personal copy. This test user can edit the file in Excel Online or Edit in Excel but won't allow downloading a personal copy. I haven't fully tested your scenario so I'm unsure if this can be applied to just specific libraries and/or document library folders (instead of being applied to all site collections within a tenant) but what I've tested so far is working to block downloads.

Azure AD Conditional Access Session policy
Download a Copy: Excel Online
Test user trying to download file that policy has been applied to

Author

Commented:
wow.
Let me try this when I get home
Christina WheelerSolution Architect

Commented:
Here's another link that might help - Conditional access and blocking downloads
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

bbaoIT Consultant

Commented:
Is it possible to have an edit permission which prevents downloading the file?

technically, once Edit permission is allowed then there is NO a ultimate way to prevent users from downloading the Excel file. the given options on SharePoint only prevent the users from previewing the document. in other words, once the file has been loaded into a local copy of Excel, the user can do Save As. even the "Save As" can be blocked as per policies applied to the Excel app, the user still can do copy all then paste all to actually copy the content to a new Excel workbook.

basically, Edit but no Download are a paradox, as locally editing including downloading is part of normal authoring job.

the only possible way is to only allow using online Excel and disable download.

Author

Commented:
the only possible way is to only allow using online Excel and disable download.


So that is the real end I have reached.  We will implement that only Excel online is used for certain documents, but Is there a way to disable the download?

Christina, what conditions did you specify for your policy.  I notice you had 2.


Also, is Azure Active Directory available with all Office 365 plans for business or only enterprise?

Author

Commented:
So I talked with Office 365 support and they solved it.  You need to setup a new permission by copying the read permission and then modifying it.   Then you have to make sure the folder that it is applied to has no inheritance from the parent folder with Everyone access removed.  Then apply the new permission.  

Thanks for all your help!
Please see above solution.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial