# How to block or limit file downloads from SaaS apps

Block downloads in app permissions, only on unmanaged devices, or in the browser. Cover the rest with rules on who may export, where files go, and a record.

Updated: October 16, 2026

There are three places to stop downloads from cloud (SaaS) apps: in the app's own permissions, only on devices you don't manage, or in the browser. A downloaded file moves onto the device, so taking away the app permission later doesn't delete it. To stop a file from leaving, you have to block the download before it happens.

## Blocking downloads in the app's own permissions

An app's own permissions can separate people who only view from people who can download, per person and per folder or record type. Three apps show how this works:

| App | Setting that blocks it | Plans | Gaps |
| --- | --- | --- | --- |
| Google Drive | Data protection rule: "Disable download, print, and copy" | Enterprise, Frontline, Education and Enterprise Essentials Plus tiers; no Business editions | Editors can still copy text and images inside the file. Printing in Preview mode still works |
| Box | Invite people to the folder as Previewers | Business and Enterprise, once an admin turns it on | A file shared on its own offers only Editor or Viewer. Previewers can save files offline in the mobile app if the admin allows it |
| HubSpot | Turn off Export, or require approval for exports | Set per user | Super Admins have every permission |

In Google Drive, an admin sets this up with a data protection rule, a rule in the Admin console that stops data from leaving. You can apply it to commenters and viewers only, or to everyone, owners included. Google's list of supported editions covers Enterprise Standard and Plus, Frontline Standard and Plus, Education Fundamentals, Standard and Plus, and Enterprise Essentials Plus. None of the Business editions is on it. The help page adds that someone who already has the file open isn't restricted until the file reloads.

Box sets this through the role you give each collaborator on a folder. Its help center says Viewers can download and print, and Previewers can't. Previewers can only preview files in Box's viewer, and can't select and copy text. If someone holds more than one permission set, the least restrictive one wins. If the admin allows it, Previewers can still save files for offline use in the Box mobile app.

HubSpot, a sales and marketing app, has an Export permission. Its user permissions guide says it lets a user export CRM (customer) records and reports. Two related settings let you require approval: one lets a user export without approval, the other lets a user approve other people's export requests. Super Admins get every permission in the account, so keep that role to the few people who need it.

## Blocking downloads only on devices you don't manage

If downloads are fine on company computers but not on personal ones, use a setting that looks at the device.

For SharePoint and OneDrive in Microsoft 365, go to Access control in the SharePoint admin center, choose Unmanaged devices, then "Allow limited, web-only access". Microsoft says people on unmanaged devices then get browser-only access. They can't download, print or sync files, and can't open them in apps, including the Office desktop apps, but they can preview them. The setting relies on Microsoft Entra Conditional Access, Microsoft's rules for who may sign in from what device or place. Conditional Access needs Microsoft Entra ID P1 or Microsoft 365 Business Premium.

Microsoft points out gaps. "Anyone" links, the ones that open without signing in, aren't covered, so anyone holding such a link can download the file. Microsoft says to turn those links off on sites where you use this. An option that allows downloading files that can't be previewed, such as .zip files, offers less security. Microsoft also recommends turning the policy on for some users first and testing it with the apps you use.

Google Drive can combine its data protection rule with Context-Aware Access. That Google feature decides who can open an app based on things like user identity, location, device security status and IP address. Google's example blocks downloads only on devices an admin hasn't approved. Google lists the same editions as above, minus Education Fundamentals. For conditions about a computer, you must first turn on endpoint verification, which reports the computer's state to Google.

## Blocking downloads in the browser

If the app has no setting, Chrome can block downloads on the browser side with a company setting. Chrome Enterprise Core, which manages Chrome from the Google Admin console at no additional cost, includes a setting called DownloadRestrictions. Value 3 blocks every download, and Google doesn't recommend it except for special cases. None of its values picks out sites, so downloads from sites that have nothing to do with work stop too.

Google's help says the setting blocks clicking a download link and choosing "Save link as". It doesn't cover saving the page with "Save page as" or printing it with "Save as PDF". It reaches Chrome on computers the company has enrolled and Chrome signed in with a company-managed account. The second case includes personal computers. Any other Chrome, or another browser, ignores it. [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data) explains when company settings reach a personal computer.

## Apps with no setting, and shared accounts

A shared account is one username and password used by several people. App permissions can't tell those people apart. The permissions belong to the account, so everyone using it can do the same things, and you can't stop just one of them from exporting.

Where neither the app nor the browser can block it, rules and records fill the gap. Decide who may export and for what, where the files go, when they're deleted, and keep a record of who exported what and when. [Limiting order and customer data exports at an e-commerce agency](/guides/agency-accounts/ec-order-data-download-control) shows how to set these. Rules don't block the export itself, so you check afterward whether they were followed.

## What download blocking leaves open

The settings in this article cover downloading, exporting, printing, copying and syncing. None of them covers screenshots, so anything shown on screen can still be captured. Treat download blocking as a way to cut down whole files leaving, and pair it with permissions that limit who can see the data at all. [How to keep applicant data from leaving your hiring tools](/guides/hr-access/preventing-applicant-data-exfiltration) walks through each route, using hiring as the example.


## Frequently asked questions

**Can people who only view files be stopped from downloading them?**

In Google Drive, a data protection rule can apply to commenters and viewers only. In Box, invite people to a folder as Previewers. Both depend on your plan.

**Can downloads be blocked only on personal devices?**

SharePoint and OneDrive can give unmanaged devices browser-only access with no downloads, which needs Entra ID P1 or Microsoft 365 Business Premium. Google Drive can pair its rule with device conditions.

**Can a Chrome setting block downloads from just one service?**

No. DownloadRestrictions has no option to pick sites, and value 3 blocks every download. It reaches enrolled Chrome browsers and Chrome signed in with a company-managed account.

**How do we limit exports from a shared account?**

App permissions attach to the account, so you can't block one of the people who share it. Block in the browser, or set rules on who may export, where files go and when they're deleted, and keep a record.

## Sources

- [Google Workspace Admin Help: Prevent users from downloading, printing, or copying files](https://knowledge.workspace.google.com/admin/security/dlp-disable-download-print-copy?hl=en)
- [Google Workspace Admin Help: About DLP for Drive](https://knowledge.workspace.google.com/admin/security/about-dlp-for-drive?hl=en)
- [Google Workspace Admin Help: Context-Aware Access overview](https://knowledge.workspace.google.com/admin/security/about-context-aware-access?hl=en)
- [Google Workspace Admin Help: Combine data protection rules with Context-Aware Access conditions](https://knowledge.workspace.google.com/admin/security/combine-dlp-rules-with-context-aware-access-conditions?hl=en)
- [Box Support: Understanding Collaborator Permission Levels](https://support.box.com/hc/en-us/articles/360044196413-Understanding-Collaborator-Permission-Levels)
- [HubSpot Knowledge Base: HubSpot user permissions guide](https://knowledge.hubspot.com/user-management/hubspot-user-permissions-guide)
- [Microsoft Learn: Control access from unmanaged devices, SharePoint in Microsoft 365](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)
- [Microsoft Learn: Microsoft Entra Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview)
- [Chrome Enterprise and Education Help: Prevent users from downloading harmful files](https://support.google.com/chrome/a/answer/7579271?hl=en)
- [Chrome Enterprise and Education Help: Chrome Enterprise Core](https://support.google.com/chrome/a/answer/9116814?hl=en)
- [Chrome Enterprise and Education Help: Set Chrome policies for users or browsers](https://support.google.com/chrome/a/answer/2657289?hl=en)

## How Junify handles this

**Doing this by hand** Single sign-on and multi-factor authentication don't reach apps that can't connect to your identity provider, or accounts that stay shared. Those are left to manual work, and you have to track for yourself which accounts the tools cover.

**With Junify** In Junify, you allow or block downloads for each shared account. When downloads are blocked for an account, they stop for anyone who opens it from Junify, so you don't go around asking people whether they deleted downloaded files. Uploads are detected and reported to admins, and each use is recorded by person. Change the password when you add the account, so only Junify holds it and people can't sign in elsewhere, where downloads aren't blocked.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=access-basics&slug=saas-download-restriction)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What's the difference between an audit log and audit evidence?](/guides/access-basics/audit-log-vs-evidence): An audit log is what a system records. Audit evidence is a log you can rely on: tied to a person, protected from change, kept for a set period, and reviewed.
- [What a browser extension can and can't control in access management](/guides/access-basics/browser-extension-access-control-scope): An extension works inside the browser it's installed in, on the sites it's allowed to run on. Other apps, other browsers and other devices are out of its reach.
- [What work data stays on a personal computer, and how to keep it off](/guides/access-basics/byod-leave-no-business-data): History, cookies, saved passwords, password manager copies and downloads. Pair company browser settings with logins that don't show people the password.