SP Online 'Shared Documents' opening as Read-Only in Word

Question

By default our users have Visitor/Limited access to many site collections, but there are some business requirements to allow them to edit documents. This issue only affects users with Read-Only/Visitor access to documents -- Contribute and higher do not have this issue.

When a document is ready for co-authoring, the user will click on the 'Share' option and invite individuals with the 'Can edit' option. The user will receive the invitation in their e-mail, and the link will by default open the Word Online editor.

Editing the document using the Word Online editor is successful, but feature lacking, so users opt for using the option to 'Edit in Word', which opens the file in Microsoft Word.

Here's where the issue happens: When the document is opened in Microsoft Word, it's being opened as READ-ONLY as if the permissions are not being correctly picked up by the client. Attempting to File -> Save As to the SharePoint location results in an error.

Any guidance is appreciated.

Answer 1

After working with MSFT on this it appears that this is tied back to a feature called Limited-access user permission lockdown mode.

There is a lack of documentation out there, but ultimately when this feature is enabled it will restrict users who do not have read-only access on the site collection from being able to make web service calls to the appropriate endpoints. This is why you are able to open the file, but any modification fails since it can't hit the Author.dll or other ASMX pages.

Some additional reading:

https://support.microsoft.com/en-us/kb/3039997

The Limited Access permission level is unusual. It lets a user or group browse to a site page or library to access a specific content item without seeing the whole list. For example, when you share a single item in a list or library with a user who doesn't have permission to open or edit any other items in the library, SharePoint automatically grants limited access to the parent list. This lets the user see the specific item that you shared. In other words, the Limited Access permission level includes all the permissions that the user must have to access the required item.

Hope this helps anybody else out.