How can we give a permission to users non- downloaded document files and non- printable in Azure active directory.

Question

How can we give a permission to users non- downloaded document files and non- printable in Azure active directory?

Answer 1

To ensure users cannot download or print document files, you can achieve this using Microsoft Entra ID in combination with Microsoft Purview Information Protection and Conditional Access Policies.

1. Enable Azure Information Protection (AIP):
   • Use Microsoft Purview Information Protection to apply labels that classify and protect documents.
   • Create a custom label that applies restrictions such as "view-only," disabling download and print options.
2. Configure Protection Settings in the Label:
   • In the AIP or sensitivity label configuration:
     • Set permissions: Choose "Viewer" or "Read-only" permissions.
     • Disable downloading, copying, or printing.
   • Assign this label to the required documents.
3. Apply Conditional Access App Control:
   • Configure Conditional Access policies in Microsoft Entra ID with Session Controls:
     • Navigate to Microsoft Entra admin center → Security → Conditional Access.
     • Create a policy that applies to cloud apps like SharePoint Online or OneDrive.
     • Enable Session Control and select Use Conditional Access App Control.
   • Use Microsoft Defender for Cloud Apps (MDCA) to enforce session policies:
     • Create a session policy to block download and printing actions.
4. Restrict Access for Specific Groups:
   • Scope the policy to target specific users or groups who should have restricted access.

This approach should work for files stored in SharePoint Online, OneDrive, or other supported cloud applications. To extend control, you can combine this with Conditional Access App Enforcement to ensure files remain protected outside the controlled environment.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin