Restrict files to open in Browser ONLY for read-only guest users

Question

Reposting from Microsoft Community question following advice from MS Agent

Hi,

 

We have several guest users with access to our tenant and by default all of our document libraries are configured to open documents in the Word app, however we’ve had a few recent issues with read only users trying to open documents and receiving error messages when the Word app tries to open them, but when they right click and select “Open in Browser” instead, the document opens up fine. While these issues appear to resolve themselves and guest users are soon able to open docs on both platforms again, I'm now wondering if it's possible to just restrict guest users with read only access to only open documents in the browser by default, and hide the “Open in app” option from them altogether?

 

I thought I’d cracked it, and had set up a “Restricted Read” permission level with the following:

 

View Items

Open Items

View Application Pages

View Pages

Use Remote Interfaces

Open

 

When I tested this permission level with a test guest account, as desired the "Open in app option" wasn’t available, however when I actually tried to open a document and clicked the document name, literally nothing happened. Simply nothing happens at all, and instead I need to right-click every time and select "Open in browser" manually, and only then will the document open up in the browser. At first, I wondered whether this was a browser issue, but I have now tested on Chrome, Edge, Firefox, and Opera, and it’s the same for all - nothing happens if you click the document name unless you manually right click and choose to open the document in the browser.

 

In essence, I want to configure it so that external guest users with read only access can only open documents in the browser - Is there any solution or workaround or alternative permissions to allow for this functionality? If I change the settings in all of our libraries to open in browser by default, then our internal users and guest users with edit access will complain, but if I leave this “Restricted Read” permission as it is and actually push it out amongst the read only guest userbase, they’re likely to complain because they’ll now have to carry out one more step to open a document every time.

Any assistance on this would be much appreciated – thank you!

Answer 1

Per my test, if you set by default open document in the client app, users must have to right-click then select "Open in browser" manually to open documents in the browser.

To prevent external users opening documents in the client app, conditional policy is another choice.

Here are steps:

1.Go to Azure Active Directory admin center -> Protect&secure -> Conditional Access -> New policy.

2.In the Users section:

3.In the Cloud apps and sections:

4.In the Conditions section:

5.In the Grant section:

6.Enable policy.

7.When external users open documents in the client app, it shows:

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.