onenote-install-auth

# OneNote Install & Auth ## Overview Set up Microsoft Graph API authentication for OneNote using delegated credentials via MSAL. This skill walks through Azure AD app registration, SDK installation, permission scope selection, token caching, and connection verification for both Python and TypeScript. **BREAKING CHANGE (March 31, 2025):** App-only authentication (ClientSecretCredential) was deprecated for OneNote APIs. All integrations MUST use delegated auth — DeviceCodeCredential or InteractiveBrowserCredential. If your existing code uses `ClientSecretCredential` with OneNote endpoints, it will receive 403 Forbidden on every call. This skill provides the correct migration path. ## Prerequisites - Azure account with permission to register applications (Azure AD admin or Application Developer role) - Node.js 18+ or Python 3.10+ - Access to [Azure Portal App Registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps) - A OneNote account (personal Microsoft account or Microsoft 365 work/school account) ## Instructions ### Step 1: Register an Azure AD Application 1. Navigate to [Azure Portal > App Registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps) 2. Click **New registration** 3. Set the **Name** (e.g., `onenote-integration-dev`) 4. Under **Supported account types**, choose: - **Single tenant** — only your organization (most restrictive, recommended for internal tools) - **Multi-tenant** — any Azure AD directory (needed if ...