Copilot for Microsoft 365 Tech Accelerator
Feb 28 2024 07:00 AM - Feb 29 2024 10:30 AM (PST)
Microsoft Tech Community
SOLVED

Read Only Access for OneDrives Users

Copper Contributor

Can an admin restrict access for users of content in their own enterprise OneDrive to read only. 

 

For example, for John's no longer wants to store more data on his OneDrive and wants it locked down so he doesn't accidently store data there anymore now that he's using another DMS.  Is there a way to limt John to read only access to his own OneDrive?

3 Replies
best response confirmed by lchow0805 (Copper Contributor)
Solution

No, not really, at least not in any supported way. Users are added as site collection admins for their own ODFB, and thus can override any permission restrictions. Removing the site admin role will put you in "unsupported" configuration and will likely break a thing or two. Pinging @Juan Carlos González Martín just in case :)

Thanks Vasil. I did some quick testing with a colleague. I was removed from the site admin role from my own sit collection. Granted myself as read only permission and was only able to access my business OneDrive files from the File Explorer. When I logged onto OneDrive via browsers, all the files weren't there - I'm guessing because syncing was turned off since write access was removed. Ended up reverting it because it wasn't the ideal outcome the users asking would have wanted.
You can now set a OneDrive location to ReadOnly. OneDrive is just a SharePoint site, so you can use the same command you would on a SharePoint site:
--- Set-SPOSite -Identity "<SiteURL>" -LockState "ReadOnly"

https://learn.microsoft.com/en-us/sharepoint/manage-lock-status#change-the-lock-state-for-a-site

Hope this helps.
1 best response

Accepted Solutions
best response confirmed by lchow0805 (Copper Contributor)
Solution

No, not really, at least not in any supported way. Users are added as site collection admins for their own ODFB, and thus can override any permission restrictions. Removing the site admin role will put you in "unsupported" configuration and will likely break a thing or two. Pinging @Juan Carlos González Martín just in case :)

View solution in original post