Stream embed permissions

lionel1055 - Embed works off the actual permissions of the video file. The "Everyone in my Organization" share links don't grant actual permissions to a file until someone clicks it. Once they click the link then the permission gets set on the file. That's why you are seeing what you are seeing. 

However, if you use the share link type of "People you choose" it assigns the permissions as soon as the link is created because it knows who the people are. 

You are right that today in the "Manage access" dialog when you set "Direct access" you can't set block download / view only. There is also the "everyone except external users" group that if it's not disabled at your organization will work to assign direct access to "everyone in the organization" whatever permissions you want. That's something I'm working with the ODB/SPO share team to see if they can enhance exposing both "everyone except external user" as a top-level concept in the UX as well as view+block download. 

As a workaround can do this...

Do you have a security group or M365 Group/Team that you want to grant view only + block download access to so that you can embed the video?

If so, the following should work.

1. Go to "Share" for the video
2. Change the link type to: "People you choose"
3. Change the settings to "Can view" and "Block download" to "On"
4. Apply
5. Now type in the name of the security group or M365 Group / Teams team that you want to give access to 
6. You can just click "Copy link" and it creates the link for that group/team and they'll have access instantly without needing to click the link.