Graph API - required permissions for createSession

The workbook/createSession API only supports delegated permissions with a work or school account. Application permissions are not supported for this API.

From the permissions table for workbook: createSession:

• Delegated (work or school account): Files.ReadWrite (least privileged)
• Delegated (personal Microsoft account): Not supported
• Application: Not supported

Because the call is being made with an Azure AD app registration using application permissions, the service is effectively trying to operate without a signed-in user context and cannot obtain edit rights on the workbook, which results in the EditModeAccessDenied error.

To use createSession successfully:

1. Use delegated permissions (Files.ReadWrite) instead of application permissions.
2. Ensure the signed-in user has edit access to the target workbook in OneDrive/SharePoint.
3. Call:

      POST /me/drive/items/{id}/workbook/createSession
      Content-type: application/json
      
      {
        "persistChanges": true
      }
   

   with an access token obtained on behalf of that user.

If an app-only (daemon/service) scenario is required, a different approach is needed because workbook/createSession itself cannot be used with application permissions.

References:

• workbook: createSession
• Working with Excel in Microsoft Graph
• Best practices for working with the Excel API
• workbook resource type