This feature is currently only available to super administrators of Pro or Enterprise edition. Please contact sales to upgrade.

I. Intro

This feature helps organizations manage file access permissions to protect their data. You can configure file permissions for all employees, or set specific permissions for certain departments and user groups by allowing or restricting them from doing the following:

Upload documents, images, videos, and other files to the cloud, Chats, or Calendar.
Download, export, and print files from the cloud, Chats, and Calendars, or open documents with third-party apps.
Make copies of Docs or copy and paste content within Docs.
Share documents with external parties.

Share images, videos, files or local files to external users via chats.
Preview images, files or Calendar events in chats.

Administrators can also choose whether to determine permissions based on IP fence settings. (No.4 and No.5 not supported for the time being)

II. Steps

On Lark Admin Console, click Security > User Permissions > File permissions.

Click Details > Edit to set the main and supplementary rules for each file permission. Hover over the question mark to see details.

Select allow or restrict members' permissions in the applicable scope in supplementary rules. In Conditions (optional), select the IP segment configured. For more details, see Configure IP fence settings.

If permissions are restricted, members won't be able to click the corresponding button related to that action. See below for reference:

III. FAQs

How can I check whether a member's file permissions are restricted?

Click Verify Permission Rules.

Enter the user's name, email, or phone number. Select the activity and click Verify to search.

How do I restrict certain permissions for members across departments?

You can create a user group and add selected members to that group. You can then select that user group for the rule's applicable scope.

Check out Manage User Groups to learn more.

How do I delete multiple members at once from the applicable scope?

For now, you can only delete members one by one by clicking the trash icon. Stay tuned for further updates.

I've already set "Add external collaborators to Docs/ turn on external sharing" for all members. Why are some members still unable to share externally?

Go to Security > User Permissions > Docs settings. Add external collaborators to Docs/ turn on external sharing is only effective and prioritized when it displays allow members to share files and folders with external users under Files and folders external sharing.

For example, this may happen when an administrator sets restricts all under Add external collaborators to Docs/turn on external sharing in the File operation permissions page and the supplementary rule is that only member A can share externally when member A actually cannot. In this case, please have the administrator check whether Restrict members to share files and folders with external users is selected.

Can all file permissions be set based on IP fence settings?

Add external collaborators to Docs/ turn on external sharing and share local files externally are not based on IP fence settings.

Why was a member unable to download or modify files under the allowed IP segment?

This may happen when administrators have set that members can only download files when using intranet (company internal network). When a member downloads a file through an application or an API, the IP address obtained by the server is the public IP address of the application—instead of the intranet—so the action is prohibited.

How do I set that only department A is permitted to download but not share local files externally within the company network without affecting other departments?

First, click Learn more under Download/export/ print in the File operation permissions page. Set the main rule as Allow all, the applicable scope for the supplementary rule as Department A, select organization IP segment, select Allow, and click Save.
In the File operation permissions page, click Learn more under External sharing for local files. Select Allow all in the main rule and select Department A as the applicable scope of the supplementary rule. Select Restrict and click Save.

For members on business trips, can they access Docs that need an VPN or SDP to connect to the company’s network segment?

Yes, they can. Network segments recognize IP addresses by the network traffic. By using security proxy tools such as VPNs or SDPs, members will be able to access these Docs. If access is denied after using a proxy tool, please reach out to members in charge of the proxy tool.

The company's network segment has already been given access to Docs, why doesn't it work?

Please check to make sure you are connected to your company's network. Network segments recognize IP addresses by the network traffic. If you are connected to the company's guest WIFI or using proxy tools, the network traffic may not belong to your company's network segment, and may cause problems.

Note: If the problem still exists after completing the steps mentioned above, please check your system time and adjust it to match with that of the servers'.