1

I have recently been made aware of a gaping security flaw within access requests on sharepoint online. Some of the data on our site is used for reference material and not allowed for download. The users that require access to these files are granted View-Only access. Several users have found a way to bypass the View-Only permissions. They click share the doc, attempt to share it with themselves, sharepoint auto generates an email.(sends one to admin and one to user who made access request) The user then just needs to open the email and click the url within the message. They can then view and save the file. All with View-Only permissions. I had one guy suggest I disable access requests.. I don't want to disable sharing on sharepoint, I just want the permission levels to work correctly. Hopefully I am just configuring them wrong.

1

As far as I know you don't have the option to disable downloading documents. You can make it inconvenient at most.

I do agree that the documentation states it differently for view permissions:

View pages, items, and documents. Any document that has a server-side file handler can be viewed in the browser but not downloaded. File types that do not have a server-side file handler (cannot be opened in the browser), such as video files, .pdf files, and .png files, can still be downloaded.

If you really want to be secure, check out Information Rights Management. That gives you far more control on the content.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.