A human co-author sits inside Word, Excel, or PowerPoint’s live merge session. A bot like ForgeBot usually reads or downloads a file, edits a separate representation, then uploads or writes back a new version.
In normal Microsoft 365 automation, an external bot is not a live cursor in the Office co-authoring session. It can be a file processor, a Graph client, an Excel API caller, an Office add-in backend, or a Copilot-integrated agent. Those are useful, but they are not the same as being a native co-author editing the same server-side document surface in real time.
The safest pattern is: bot suggests or prepares changes, a human reviews, then changes are inserted through Office, an approved add-in, or a controlled upload that checks version and lock state.
| Route | Can edit? | Is it a true co-author? | What it means in practice | Risk |
|---|---|---|---|---|
| Microsoft Graph DriveItem file upload/download | Yes, whole file | No | Download the .docx/.pptx/.xlsx stream, modify with a library, upload/replace content. This is the pattern Adam described. | Can collide with active Office locks; may overwrite unless guarded with eTags, versions, and conflict handling. |
| Microsoft Graph Excel workbook APIs | Yes, object-level Excel | Partial | Read/write worksheets, ranges, tables, charts, and formulas through persistent sessions. | Excel-specific; not available for Word/PowerPoint content editing through Graph. |
| Office.js add-in | Yes, inside open Office app | Adjacent | Runs in a user’s Office session and can read/write the open document with that user present. | Not an unattended bot in the file; add-in state is per-user and must handle stale data/coauthoring events. |
| Microsoft 365 Copilot app-native agents | Yes, within Microsoft’s product boundary | Microsoft-native | Copilot can create and edit files through Office-native capabilities while the user remains in control. | Available only through Microsoft’s Copilot stack, admin controls, licensing, tenant policy, and model-provider constraints. |
| WOPI cloud storage integration | Yes, for storage providers | Enables co-authoring, not bot editing | Lets Microsoft 365 for the web edit files stored in a partner storage service. Office for the web manages coauthor sessions. | Cloud Storage Partner Program is for storage ISVs, not ordinary Microsoft 365 customers or standalone bots. |
| Headless browser automation of Word for the web | Technically possible | Bad idea | A bot could impersonate a user’s browser interaction and type into Word for the web. | Fragile, hard to govern, likely against enterprise reliability/security expectations, and not an API contract. |
Graph can manage files stored in SharePoint/OneDrive and replace file content, but Microsoft Q&A guidance states there is no Microsoft Graph Word API for editing Word content. For Word and PowerPoint find/replace, Microsoft guidance points developers toward downloading the file stream, using a document-processing library, and uploading it back.
Excel has a Microsoft Graph workbook API. A bot can create a persistent session and change workbook objects, and those changes are saved. That makes Excel the closest thing to supported server-side bot editing, but it is still an API session against workbook objects, not a visible co-author cursor in the same way a human editor appears.
Bot gets the file through Graph, SharePoint, OneDrive sync, or a user upload.
Bot extracts text or unpacks Office Open XML into a workable representation.
Bot proposes changes or modifies a local/in-memory copy.
Bot checks version, eTag, permissions, and lock failure signals before write-back.
Bot uploads a new version, creates a copy, or hands a patch to a human/add-in.
Microsoft Q&A guidance says Graph respects Office/SharePoint locks and writes can return 423 Locked, but Graph does not expose a documented real-time lock-state endpoint. The common workaround is probe-and-handle failure, not true preflight certainty.
Graph item activity and Word/SharePoint version history can be best-effort for concurrent edits. A saved version may show only the user whose token triggered the save, even if several people contributed changes in the same interval.
Excel add-in guidance explicitly warns that workbook content syncs, but JavaScript variables and in-memory add-in state do not. Each coauthor has a separate add-in instance. That matters for any AI add-in design.
WOPI is the protocol that lets Microsoft 365 for the web access and change files stored in a storage partner’s service. For editing, a WOPI host implements CheckFileInfo, GetFile, PutFile, PutRelativeFile, Lock, Unlock, UnlockAndRelock, and RefreshLock. Microsoft 365 for the web handles live document changes internally and periodically calls PutFile.
Local ForgeApps references show SharePoint upload workflows for generated .docx and .xlsx files, including proposal documents and cost tables. The documented semantics are idempotent upload/overwrite by name, not live Office co-authoring participation.
In this Slack thread, ForgeBot can research, draft, create files, publish previews, and potentially use Microsoft Graph if credentials and permissions are available. It is not currently a Word/PowerPoint/Excel co-authoring client with a live cursor in a SharePoint document.
423 Locked.