How to least privilege Microsoft Graph API daemon application permissions to a single OneDrive Excel file?

Question

Trying to leverage the Microsoft Graph API within a daemon application to update a single OneDrive Excel file. How do I accomplish least privilege permissions to a single file. I have scoured the documentation for a straightforward explanation of this basic task, however no articles are instructive on how to proceed with this. The documentation appears to define least privilege as a distinction between the Office software entities, but not within folders and files of a OneDrive. Thanks in advance for guidance.

Answer 1

This isn't possible. The Files.{Read|ReadWrite}.All application scopes provide access to the entire Drive for every user.

From the Permissions documentation:

• Files.Read.All: Allows the app to read all files in all site collections without a signed in user.

• Files.ReadWrite.All: Allows the app to read all files in all site collections without a signed in user.