How to set Default version to Protected and update sync replicas?

[JeremyBridges]

A client of ours wants to protect their Default version from edits by non-owners or non-admins, yet still allow them to take sync replicas from a feature service and keep them updated. The remote users will not have edits to transmit back to the enterprise. They just need to get updates that are added to Default. Seems best to enable only Sync and Query on the feature service. What other steps should they take to allow them to use sync replicas in this way?

[JeremyBridges]

Got this reply from one of the devs on the Server team:

I think in this case the underlying replica is a 2 way replica even though the FS sync limits it to only sync download (based on only query and sync capabilities). As I remember, a 2 way replica is always created behind the scenes as it can support any of the sync direction options the feature service may be configured to support.

In this case you could publish the feature service using the databases SDE user but limit the FS capabilities to query and sync. That way non-owners / non-admins will not be allowed to edit the data through the feature service (data is still protected via the FS) but the back end server SOC process will work as it will connect as SDE.

Great advice. Thanks you!