I've got a document library in which I've given some users "Restricted View" permissions since we need to block printing and downloading. I've confirmed that the documents in the library inherit their permissions from the document library. When these users open a Word or Excel file it works fine:

enter image description here

but opening a PDF gives this:

enter image description here

Like I said, there are no specific permissions set on the documents themselves. And looking at the access on each document shows these people have "Restricted View" permission on all these files.

I set up a test user with the exact permissions of these users and logged in as that test user in Chrome Incognito mode as well as Internet Explorer. I can open both the PDFs and Office files without any problem.

I noticed in the preview pane it was complaining about IRM:

enter image description here

What's weird is that I just looked in the library settings and IRM is turned off. I don't know why IRM is in play here at all...

Any better ideas?

  • I would just add that I experimented with other permissions, and Restricted View is the one that I need: it effectively blocks all printing and downloading. But despite having turned IRM on and off again (I saw someone suggested trying that) and adding and removing permissions - Office files can still be opened while PDFs trigger an "access denied" error. :(
    – Eliezer
    Commented Aug 12, 2020 at 20:08
  • I see someone reported the PDF-specific "access denied" issue when used in conjunction with "Restricted View" on GitHub.
    – Eliezer
    Commented Nov 5, 2021 at 18:40

4 Answers 4


For the occasionally access denied error, please refer to https://docs.microsoft.com/en-us/sharepoint/troubleshoot/administration/access-denied-or-need-permission-error-sharepoint-online-or-onedrive-for-business

For the IRM in office online display issue, please refer to https://docs.microsoft.com/en-us/office/troubleshoot/administration/office-online-limitations-and-features-with-information-rights-management

  • I don't think either of those will help. It's not an occasional access denied error, it's consistently access denied on all PDFs whereas all Office documents work just fine. Like I mentioned in my OP, IRM is turned off for this library, so IRM shouldn't be interfering at all. Also, I've checked the permissions on the specific documents: both the Office and PDF documents are inheriting from the library and the users have identical, appropriate permissions on all files.
    – Eliezer
    Commented Aug 10, 2020 at 16:13

Create a custom permission level for users that should have Restricted View by following these steps:

  1. Go to Settings and click Site permissions and select Advanced permissions settings.

  2. Select Permission Levels and click Add a Permission Level.

  3. Type in the name of permission level and tick the following permissions which only allow user to view pages, list items and documents but not download.

permissions config image #1 permissions config image #2 permissions config image #3

  1. Save the custom permission level.
  2. Then assign this permission level to the user or group(s) which should be able to view the pages, list items and document but not download.
  • Fritz, I tried exactly what you suggested but my test user still had the ability to both print and download - both PDFs and Word docs. So I removed as many permissions as possible from my custom permission level, while still allowing opening documents -- LIST PERMISSIONS: View Items | View Application Pages; SITE PERMISSIONS: View Pages | Open; PERSONAL PERMISSIONS: (all unchecked) Even after setting it like that, they could still print and download - both PDFs and Word docs. In other words, this minimal setting was even more permissive than the native Restricted View permission.
    – Eliezer
    Commented Nov 5, 2021 at 18:08
  • Is the ‘Limited Access User Permission Lockdown mode’ feature enabled for this site collection? Commented Nov 5, 2021 at 18:44
  • Should it be enabled? It is not --- on ourcompanydomain.sharepoint.com/_layouts/15/…
    – Eliezer
    Commented Nov 5, 2021 at 19:36
  • Something just occurred to me that may also be the culprit: 1.)What browser are your users suing? iE11, Google Chrome or Edge Chromium? 2.)Do any of these users have Adobe Acrobat products installed? If either is true, the answer to you issue is browser / app based- not SharePoint based. For #1: Edge and Chrome have built-in PDF viewers and light editors which hijack the MIME type. You need to render the PDFs using the Word Online app using PowerShell- I think SP Online supports this. As for #2: get any Acrobat programs removed from your client’s computers-its an attack vector Commented Nov 6, 2021 at 4:31
  • So, I just got off my mobile phone and was able to confirm there is no equivalent to the New-SPWOPIBinding command for SharePoint Online. That means that if your users are using Edge (Chromium) and/or Google Chrome, or even IE11: the setting you need to switch is: Library Settings➡Advanced Settings➡"Opening Documents in the Browser" ⩶ "Open in Browser". This setting should trigger the Word Online app to render it in the browser. If this doesnt fix your issue, I am at a loss. If this does fix your issue, mark my answer as the answer and I will edit it with the comment info Commented Nov 6, 2021 at 4:56

I recently experienced this problem on a site where users had zero access on the site by default but were being given view only access directly to individual documents. I saw these access denied errors specifically when users were accessing none MS office documents.

It turned out it was the 'Limited-access user permission lockdown mode' feature causing this. Disabling this resolved the problem.

Limited-access user permission lockdown mode

Another symptom we had was this confusing error message when a view only share link was created:

"This link does not provide download capability for the shared content."

This link does not provide download capability for the shared content.

I'm a little late to the show here but posting incase anyone is stuck with a similar problem.


Maybe you can fix it by going to the basics. Try renaming the users and if it doesn't happen again try giving them full access and then restricting it back. If not this blog is actually quite helpful at times https://blog.runscrum.io/ check it out if need it.

  • Klaus, what do you mean "renaming the users"? Their names are pulled from AD and are their ...names. Also, I did try giving them "Full Control" then moving them back to "Restricted View" - same problem. And lastly, was there a specific, pertinent article on your website to which you were referring me?
    – Eliezer
    Commented Aug 13, 2020 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.