Edit Sharepoint Excel file online only but prevent user from downloading personal copy

Yes this can be accomplished through Azure AD Conditional Access - Policies but it does require Azure AD Premium P1. You can setup policies to block specific users from being able to download. I used a test account to test the policy I created and it does block them from downloading a personal copy. This test user can edit the file in Excel Online or Edit in Excel but won't allow downloading a personal copy. I haven't fully tested your scenario so I'm unsure if this can be applied to just specific libraries and/or document library folders (instead of being applied to all site collections within a tenant) but what I've tested so far is working to block downloads.

wow.
Let me try this when I get home

Here's another link that might help - Conditional access and blocking downloads

Is it possible to have an edit permission which prevents downloading the file?

technically, once Edit permission is allowed then there is NO a ultimate way to prevent users from downloading the Excel file. the given options on SharePoint only prevent the users from previewing the document. in other words, once the file has been loaded into a local copy of Excel, the user can do Save As. even the "Save As" can be blocked as per policies applied to the Excel app, the user still can do copy all then paste all to actually copy the content to a new Excel workbook.

basically, Edit but no Download are a paradox, as locally editing including downloading is part of normal authoring job.

the only possible way is to only allow using online Excel and disable download.

the only possible way is to only allow using online Excel and disable download.

So that is the real end I have reached.  We will implement that only Excel online is used for certain documents, but Is there a way to disable the download?

Christina, what conditions did you specify for your policy.  I notice you had 2.


Also, is Azure Active Directory available with all Office 365 plans for business or only enterprise?

So I talked with Office 365 support and they solved it.  You need to setup a new permission by copying the read permission and then modifying it.   Then you have to make sure the folder that it is applied to has no inheritance from the parent folder with Everyone access removed.  Then apply the new permission.  

Thanks for all your help!