Resolving “Draft Item Security” Sync Blocks in SharePoint

A “Draft Item Security” sync block occurs when a SharePoint document library uses versioning and draft security controls that prevent intermediate file versions from synchronizing to desktop devices. When this occurs, users find that newly uploaded or edited documents fail to show up in File Explorer via OneDrive, changes made by colleagues remain invisible, or the OneDrive sync client halts with sync errors.

Fast Fix

Publish a major version of the affected file. In SharePoint on the web, right-click the file, select More > Publish a major version, and confirm. If the entire library should allow all contributors to see draft edits, go to Library settings > Versioning settings > Draft Item Security and change the selection to Any user who can read items.

---

Diagnostic Snapshot

Symptom	Underlying Configuration	Impacted Users
File missing completely in File Explorer	File is in minor draft (e.g., v0.1); user only has Read rights	Read-only members
Sync engine skips pending updates	Draft Item Security set to “Only users who can approve”	Standard site contributors
Red sync error on uploaded file	Check-out required before publishing major version	Document authors
“Version history not updating”	Edits continuously save to unpublished minor version	All collaborators

---

How Draft Item Security Affects Synchronization

SharePoint document libraries support two tiers of versioning: Major versions (1.0, 2.0, 3.0) and Minor/Draft versions (0.1, 0.2, 1.1, 1.2).

Under Draft Item Security, site administrators can choose who is allowed to view in-progress minor versions before an official release.

[File Edited locally] ──> Commits as Minor Version (v1.1)
                                   │
         ┌─────────────────────────┴─────────────────────────┐
         ▼                                                   ▼
[User: Edit/Approve Rights]                         [User: Read-Only Rights]
  OneDrive client downloads v1.1.                     OneDrive client ignores v1.1;
  Changes visible locally.                            Holds local copy at v1.0.

The OneDrive desktop sync client respects SharePoint permission boundaries. This creates synchronization deadlocks under three conditions:

1. Unpublished New Files (Version 0.1): When a user uploads a new document into a library configured for major/minor versions, it enters a v0.1 draft state. Until the author publishes a major version (v1.0), users with read-only permissions cannot see the file anywhere in SharePoint or File Explorer.
2. Approval Restrictions: If Draft Item Security is set to Only users who can approve items (and the author), standard contributors with edit rights cannot sync down intermediate changes made by other editors until an approver signs off.
3. Mandatory Check-Out Collisions: If check-out is required, every edit is held in an uncommitted local sandbox that blocks minor version synchronization to other endpoints entirely.

If draft security issues are causing versioning logs to stop updating, review How to Fix “Version History” Not Saving in SharePoint Online.

---

Progressive Action Steps

1. Identify the Current Version State

Before modifying library rules, check whether the file is stranded in a minor draft.

1. Open the SharePoint document library in your web browser.
2. Check the Version column. (If hidden, click Add column > Show/hide columns > check Version > click Apply).
3. Look at the version number of the problem document:
   • Version 0.x: The file has never been formally published. Only the author and administrators can see or sync it.
   • Version x.y (e.g., 2.3): The file has uncommitted minor drafts. Read-only members will only sync version 2.0.

2. Publish the Major Version

Publishing the draft immediately releases the document to all synchronization clients.

1. Right-click the problem file in SharePoint.
2. Select More > Publish a major version.
3. In the dialog box, add optional version comments and click Publish.
4. The version will round up to the next integer (e.g., v0.1 becomes v1.0; v1.2 becomes v2.0).
5. Within 60 seconds, the OneDrive sync engine will distribute the published document to all users syncing that library.

If files cannot be published because they are locked by editing processes, follow the resolution steps in How to Fix SharePoint “Checkout Required” Sync Blockers.

3. Adjust Draft Item Security Policies

If your team relies on real-time desktop synchronization, keeping Draft Item Security locked to approvers will create persistent sync confusion.

1. In the document library, click Settings gear > Library settings > More library settings.
2. Click Versioning settings.
3. Scroll down to Draft Item Security.
4. Choose the appropriate policy:
   • Any user who can read items: Recommended for active collaboration. The sync client will pull all minor edits for every user with access to the library.
   • Only users who can edit items: Suitable for editorial workflows where external viewers should only see final products.
   • Only users who can approve items (and the author): Restricted legal/compliance environments. Note: This setting halts real-time co-authoring synchronization for standard contributors.
5. Click OK to apply the configuration.

Draft Item Security Options:
├── [x] Any user who can read items     <── Fixes sync issues for all users
├── [ ] Only users who can edit items   <── Blocks read-only desktop sync of drafts
└── [ ] Only users who can approve      <── Blocks standard contributor sync

4. Reconcile Local Client Cache Mismatches

If a user with correct permissions still cannot see published files in File Explorer, the local OneDrive sync database is out of sync with cloud metadata.

1. Right-click the OneDrive icon in the system tray and select Pause syncing > 2 hours.
2. Wait 10 seconds, click the icon again, and select Resume syncing.
3. If the file still fails to populate, compare browser view states against desktop folders using Resolving “Browser vs Desktop” File Sync Mismatches in M365.

---

Hidden Problem: Content Approval Workflows

If you change Draft Item Security and files still refuse to sync down to team members, look at the top of the Versioning settings page.

If Require content approval for submitted items? is set to Yes, SharePoint enforces draft protection regardless of your column settings. Any edit automatically forces the document back into a “Pending” approval state, blocking visibility for read-only sync users until an approver explicitly marks the item as “Approved.”