Selecting Copy Link and Unchecking "Allow Editing" Does Not Prevent Document Editing

[Russ Thomson]

I have built a Power Automate workflow on a list for sequential approval of an Excel document uploaded to a Document Library. The approvers receive an approval task with a link to the uploaded Excel, and should be able to view but not edit the document, so that they can review and then approve or reject.

I instructed the users who upload the Excel and initiate the workflow to capture the Excel link by:

• selecting "Copy Link"
• selecting "People with the link can edit"
• unchecking "Allow editing" 
• selecting "Apply" (which changes "People with the link can edit" to "People with the link can view")
• selecting "Copy"

However, they found that doing this does not prevent editing of the Excel. I have run tests to confirm, and found that the only condition in which folks cannot edit the Excel is if they have Read permissions - if the above process is followed, using the resulting link, anyone with Contribute permissions or higher can edit the Excel.

Is this correct functionality? Specifying that folks cannot edit a document but they can in fact edit the document seems very misleading and I am confused as to why this is happening.

[#2]

The links will add people that don't have access to the document based on the selected permissions for internal authenticated users. If those users already have access to the library / page for edit rights, the link will not have an effect on their permissions.

I'm going to assume that they have edit rights or something somewhere else in this case. If so, you will have to use PowerAutomate to remove permissions from the item and manually change permissions or make sure that they only have read access to items.

Do they have permission already to "add" to this list prior to approvals?

[#3]

@Chris Webb - thanks for your response. I have also spoken with MS Support and they have confirmed that only folks with Read access will be unable to edit a shared document, even if Allowed Editing is unchecked - folks with Contribute access or higher will be able to edit.