Setting up video portal site for Stream (on SharePoint) to disallow downloads of videos

[KevinCrossman]

We want to set the site-wide permissions on a SharePoint comms site to prevent most users from being able to download the videos (but to be able to watch them, of course).

The View Only permission that's built into SharePoint doesn't seem to work for video files (Office file types do work).

Surely there is a way to do this?

@Marc Mroz 

[#2]

@KevinCrossman - At a library or folder level you can use the "Restricted View" permission level in the classic SP permission UI to force block download + view only. 

Library... 

1. Go to the library you want to make all files including videos view only / block download for a set of people.
2. Gear upper right > Library settings
3. More library settings
4. Permissions for this document library
5. Stop Inheriting Permissions
6. Check the box next to the "<site name> Visitors"
7. Edit User Permissions
8. Change from "Read" to "Restricted View" 
9. OK

You will now have a Library where the Visitors can view and not download files including videos.

You can do the same thing at a folder. 

This doesn't work at the Site level due to some issue with how SP Modern pages work where they don't operate with "Restricted View" permission. If you applied this at the Site level permissions users with "Restricted View" would get an access denied message navigating to the home page of the site or any site page. You might be able to overcome this by making your own custom Permission Level for the site that is a copy of "Read" but remove the permission level  "List Permissions" > "Open Items". It seems from quick testing that works to block download of all files but lets Modern SP pages still work, but I haven't tested enough to know if it has some other side effects.

I know this isn't ideal having to do this in classic permissions UI. I'm working with ODSP on a plan to try and get view only + block download elevated for Sites/Libraries/Files so it's easier to do without having to dig into SP classic UI. 

[#3]

Restricted View doesn't seem to be built into newly created Communications Sites, Team Sites, or Groups-connected Team Sites. Is there a playbook for a custom permission level that replicates this.

I created a custom permission level with:
View items
Open items
View pages
Open

And when I applied this to users they aren't able to access the document library at all.

And for videos in the library that are shown in the Activity web part, they can view the videos if they click off the thumbnail in the web part and the video does play - but they can also download the file.

[#4]

@KevinCrossman - After creating a new SP site, can you add a file and share it? I think that forces "Restricted View" to get created. (Sorry this is so silly we need to find a way to fix this and make it easy).

For a custom permission level, what I tried and seemed to work in the few cases I tested, was to make a copy of "Read" and then just uncheck "List permissions > Open items" and I kept all the other permissions that Read had by default. 

[#5]

Thanks (and yes, very very silly). When I create a fresh comms site and share one item then I do get the Restricted View option for that document library - and this does work to prevent downloads of uploaded videos.

The weird thing is that Restricted View isn't listed a permission level in the site's settings. And for my other site I can't get it to work properly so I guess I'll just recreate it. (a concern that this whole Restricted View thing may be ... brittle.).

[#6]

I created a post about to most easily create a View Only permissions level for a SharePoint site, so that videos aren't able to be downloaded.
https://www.linkedin.com/pulse/creating-view-only-permission-stream-sharepoint-videos-kevin-crossman...

[#7]

@KevinCrossman @Marc Mroz  Also having this issue. As my company-wide Viva Engage page, which is connected to our Comms Hub Sharepoint, requires all users to be able to upload media to the page for it to work as a community, this has become a huge problem. With videos either being downloadable or needing to be uploaded to a personal Sharepoint and a 'view only' link created. But with latter, when people are sharing the video with others, it's not working as they naturally just take the link from URL at top. Is there a solution?