How to block or limit file downloads from SaaS apps

There are three places to stop downloads from cloud (SaaS) apps: in the app’s own permissions, only on devices you don’t manage, or in the browser. A downloaded file moves onto the device, so taking away the app permission later doesn’t delete it. To stop a file from leaving, you have to block the download before it happens.

Blocking downloads in the app’s own permissions

An app’s own permissions can separate people who only view from people who can download, per person and per folder or record type. Three apps show how this works:

In Google Drive, an admin sets this up with a data protection rule, a rule in the Admin console that stops data from leaving. You can apply it to commenters and viewers only, or to everyone, owners included. Google’s list of supported editions covers Enterprise Standard and Plus, Frontline Standard and Plus, Education Fundamentals, Standard and Plus, and Enterprise Essentials Plus. None of the Business editions is on it. The help page adds that someone who already has the file open isn’t restricted until the file reloads.

Box sets this through the role you give each collaborator on a folder. Its help center says Viewers can download and print, and Previewers can’t. Previewers can only preview files in Box’s viewer, and can’t select and copy text. If someone holds more than one permission set, the least restrictive one wins. If the admin allows it, Previewers can still save files for offline use in the Box mobile app.

HubSpot, a sales and marketing app, has an Export permission. Its user permissions guide says it lets a user export CRM (customer) records and reports. Two related settings let you require approval: one lets a user export without approval, the other lets a user approve other people’s export requests. Super Admins get every permission in the account, so keep that role to the few people who need it.

Blocking downloads only on devices you don’t manage

If downloads are fine on company computers but not on personal ones, use a setting that looks at the device.

For SharePoint and OneDrive in Microsoft 365, go to Access control in the SharePoint admin center, choose Unmanaged devices, then “Allow limited, web-only access”. Microsoft says people on unmanaged devices then get browser-only access. They can’t download, print or sync files, and can’t open them in apps, including the Office desktop apps, but they can preview them. The setting relies on Microsoft Entra Conditional Access, Microsoft’s rules for who may sign in from what device or place. Conditional Access needs Microsoft Entra ID P1 or Microsoft 365 Business Premium.

Microsoft points out gaps. “Anyone” links, the ones that open without signing in, aren’t covered, so anyone holding such a link can download the file. Microsoft says to turn those links off on sites where you use this. An option that allows downloading files that can’t be previewed, such as .zip files, offers less security. Microsoft also recommends turning the policy on for some users first and testing it with the apps you use.

Google Drive can combine its data protection rule with Context-Aware Access. That Google feature decides who can open an app based on things like user identity, location, device security status and IP address. Google’s example blocks downloads only on devices an admin hasn’t approved. Google lists the same editions as above, minus Education Fundamentals. For conditions about a computer, you must first turn on endpoint verification, which reports the computer’s state to Google.

Blocking downloads in the browser

If the app has no setting, Chrome can block downloads on the browser side with a company setting. Chrome Enterprise Core, which manages Chrome from the Google Admin console at no additional cost, includes a setting called DownloadRestrictions. Value 3 blocks every download, and Google doesn’t recommend it except for special cases. None of its values picks out sites, so downloads from sites that have nothing to do with work stop too.

Google’s help says the setting blocks clicking a download link and choosing “Save link as”. It doesn’t cover saving the page with “Save page as” or printing it with “Save as PDF”. It reaches Chrome on computers the company has enrolled and Chrome signed in with a company-managed account. The second case includes personal computers. Any other Chrome, or another browser, ignores it. What work data stays on a personal computer, and how to keep it off explains when company settings reach a personal computer.

Apps with no setting, and shared accounts

A shared account is one username and password used by several people. App permissions can’t tell those people apart. The permissions belong to the account, so everyone using it can do the same things, and you can’t stop just one of them from exporting.

Where neither the app nor the browser can block it, rules and records fill the gap. Decide who may export and for what, where the files go, when they’re deleted, and keep a record of who exported what and when. Limiting order and customer data exports at an e-commerce agency shows how to set these. Rules don’t block the export itself, so you check afterward whether they were followed.

What download blocking leaves open

The settings in this article cover downloading, exporting, printing, copying and syncing. None of them covers screenshots, so anything shown on screen can still be captured. Treat download blocking as a way to cut down whole files leaving, and pair it with permissions that limit who can see the data at all. How to keep applicant data from leaving your hiring tools walks through each route, using hiring as the example.