Access Denied on Restricted View

The Problem

• An issue hit my desk yesterday that some users were getting access denied when trying to open an Excel file in O365 while other users could see it.

• The file was in a document library where Members were granted “Restricted View” access meaning they can view, but not print nor download Office files including Excel files. Owners had full access to the files.

  

• When some users tried to open the .xlsx file, Excel opened on their desktop, and it prompted for their log in:

  

• Entering credentials then gave access denied:

  

  What the ?

The Root Cause

The access denied occurred when a Team Member (not Team Owners who had full access) attempted to open a Restricted Document file in the Excel desktop app from the Teams desktop app.

Teams supports three ways of opening an Office file if you click on the ellipsis and Open

1. Edit in Teams
2. Open in browser
3. Open in app

This is a screenshot of the typical Teams context menu to open a file from Teams:

If the current user has set the default to “Open in app”, clicking on the filename will attempt to open a file in the Excel app even if you do not have the ability to download. However, if you click on the ellipsis, the “Open in app” option is helpfully removed:

“Open in app” requires entire the file to be downloaded to your computer so that Excel can open it. If you do not have access, Excel does not necessarily know that you came from Teams. It just knows that to open this file, you need a different account than the one that is logged in. If you do happen to have the credentials for an account with download priviliges, prompting for the username could actually be helpful.

However, most users just enter the same creds as before, and we get access denied.

Options

Here are some options to help end users who are trying to open a restricted-view file from Teams desktop when their default is to “Open in app”.

1. Remove restricted view. This allows users to download and open files in Excel desktop.
2. Share the process of clicking on the ellipsis > Open > “Open in Browser” or “Edit in Teams” as in the image above OR the process of selecting the file and clicking the Open drowpdown in the Teams ribbon as shown here:

   

3. Share the web links to the list of documets and / or files so that they open in the browser.
4. Suggest that the end users change their default from Open in app.