onenote-security-basics

# OneNote Security Basics ## Overview OneNote Graph API security changed fundamentally on March 31, 2025, when Microsoft deprecated app-only authentication for OneNote endpoints. Every integration must now use delegated authentication through MSAL, which means real users must sign in — no more background service accounts with client secrets. This skill covers the full security surface: permission scoping, token lifecycle management, MSAL cache serialization, credential storage, and multi-tenant hardening. Get any of these wrong and your integration either breaks silently (expired tokens returning 401s) or over-provisions access (Notes.ReadWrite.All when Notes.Read suffices). ## Prerequisites - Azure AD app registration with redirect URI configured at https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps - Microsoft 365 license (E3/E5/Business) with OneNote enabled - Python: `pip install msgraph-sdk azure-identity msal` or Node: `npm install @microsoft/microsoft-graph-client @azure/identity @azure/msal-node` - Understanding of OAuth 2.0 authorization code flow and delegated permissions ## Instructions ### Permission Scope Matrix Choose the minimum scope required for your use case: | Scope | Read notebooks | Read pages | Create pages | Create notebooks | Admin consent? | |-------|:-:|:-:|:-:|:-:|:-:| | `Notes.Read` | Yes | Yes | No | No | No | | `Notes.ReadWrite` | Yes | Yes | Yes | Yes | No | | `Notes.ReadWrite.All` | Yes | Yes | Yes | Yes | **Yes** | | `Notes.C...