Does the Microsoft Graph OneNote API support app-only authentication for enterprise tenants?

Question

Hi,

I'm looking for clarification on the supported authentication model for the Microsoft Graph OneNote API.

From the Microsoft documentation, my understanding is that the OneNote API requires delegated permissions and does not support app-only (client credentials) authentication.

Could someone from Microsoft please confirm the following?

1. Does the Microsoft Graph OneNote API support app-only (client credentials) authentication for reading notebooks, sections, pages, and attachments in Microsoft Entra ID enterprise/business tenants?
2. Is there any supported enterprise configuration, licensing option, or exception that enables unattended access using only an application (client ID/secret or certificate) without a signed-in user?
3. If app-only authentication is not supported, is delegated authentication always required?
4. For long-running background services, is the recommended approach to have a designated licensed user authenticate once using the Authorization Code flow with offline_access, store the refresh token securely, and use it to obtain new access tokens for background processing?
5. Under delegated Notes.Read.All, can an application access only the notebooks that the signed-in user already has permission to access, or can it read notebooks belonging to other users in the tenant?

If app-only authentication is intentionally unsupported, is there any other Microsoft-supported architecture for fully unattended OneNote ingestion?

Thank you.

Answer 1

1. No. The Microsoft Graph OneNote API does not support app-only authentication. The documentation states that the OneNote API requires delegated permissions, and the OneNote API overview states that app-only authentication is not supported.
2. No supported exception is documented for enterprise tenants. The OneNote API overview says the API does not support app-only authentication, and the newer overview states that support for app-only authentication ends effective March 31, 2025 and recommends delegated authentication.
3. Yes. Delegated authentication is the supported model for OneNote API access.
4. The supported fact is that delegated authentication is required. The provided material does not document a specific recommended background-service pattern using a designated user, offline_access, and stored refresh tokens, so that architecture cannot be confirmed here.
5. Under delegated access, the app can access OneNote data that the signed-in user can access. The documentation states:

• delegated permissions allow access to the signed-in user’s OneNote data
• me is for OneNote content that the current user can access, including owned and shared content
• users/{id} is for OneNote content that the specified user has shared with the current user
• the delegated permission description for OneNote is “Read all OneNote notebooks that user can access”

So, delegated access does not grant unrestricted tenant-wide access to other users’ notebooks. It is limited to notebooks the signed-in user already has access to.

For fully unattended OneNote ingestion using only application identity, no Microsoft-supported OneNote API architecture is documented here, because app-only authentication is not supported for the OneNote API.

---

References:

• Use the OneNote REST API
• OneNote API overview
• Microsoft Graph permissions reference
• Persistent 401 Unauthorized for OneNote API (me/onenote/notebooks) with Personal Microsoft Account - Microsoft Q&A