App access to OneNotes files in a shared Sharepoint folder.

Question

Hi,

It looks like Microsoft now requires delegated permissions to access OneNote through Graph. For scenarios where service accounts scan content (without user context), this causes an issue.

Is there any alternative for app-only access, or plans to introduce a least-privilege model for OneNote similar to other workloads?

Granting Notes.Read.All permission would not be possible.

Thanks!

Answer 1

Dear @Saxena, Akshit,

Thank you for reaching out to the Microsoft 365 Q&A forum community.  Microsoft has announced that app-only authentication for OneNote Microsoft Graph APIs was retired on March 31, 2025. Going forward, delegated permissions are required for accessing OneNote content.

This change is part of the Microsoft Secure Future Initiative to enhance security and enforce least-privilege principles. 

Currently: 

• App-only access is no longer supported for OneNote APIs. 
• The recommended approach is to use delegated permissions with admin consent for scenarios requiring broad access. 
• There is no alternative app-only model planned for OneNote due to its user-centric nature and privacy requirements. 

Refer this Blog: Microsoft announcement on retiring app-only authentication

Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link 

For more details and migration guidance, please refer to the official documentation: 

OneNote API overview - Microsoft Graph | Microsoft Learn 

Microsoft Graph permissions reference 

If your scenario involves scanning content without user interaction, you may need to implement delegated authentication with admin consent or consider alternative approaches such as accessing OneNote files via SharePoint/OneDrive APIs (e.g., downloading .one files), though this may not preserve full OneNote structure. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.