OneNote Android authentication failure: unresolved [Substrate.AuthHost] in OneNoteSubstrateMSAScope causes invalid_scope / 9hehw

Question

I am experiencing a reproducible authentication failure in Microsoft OneNote for Android 16.0.20228.20214 with a personal Microsoft Account.

The issue is reproducible both on a Samsung Galaxy S24 Ultra / Android 16 and independently on a clean AOSP Android 16 (API 36) emulator, which rules out a Samsung-specific/device-specific cause.

User-facing errors include:

Access denied for the resource Tags: 9hehw / 9hk4q

Internal OneAuth/MSAL logging reports:

invalid_scope StatusInternal::IncorrectConfiguration server error 70011

I instrumented the authentication flow and found that OneNote's own ConfigService returns the following configuration:

OneNoteSubstrateMSAScope

with:

isValid = true

but the actual value is:

https://[Substrate.AuthHost]/Notes-Internal.ReadWrite

The placeholder [Substrate.AuthHost] is not resolved afterward. The exact same value is passed through the OneNote helper, written to its cache, and finally used as the OAuth scope.

The actual authorization request therefore contains:

offline_access openid profile https://[Substrate.AuthHost]/Notes-Internal.ReadWrite

for OneNote client ID:

[PII removed]

and the Microsoft consumer tenant.

I also tested replacing the unresolved placeholder before network transmission with:

https://substrate.office.com/Notes-Internal.ReadWrite

Instrumentation confirmed that the corrected scope was present in the actual /oauth2/v2.0/token POST immediately before transmission, but Microsoft Identity still rejected the request.

Historical Substrate MSA targets were also tested:

service::substrate.office.com::MBI_SSL

and:

service::substrate.office.com::MBI_SSL_SHORT

Both were explicitly declined by the server with:

The passed in target value is invalid. Some of the scopes (targets) are declined by the server.

Tag: 9zj08

The MBI_SSL_SHORT test was confirmed in both authorization and token requests.

This strongly suggests an issue in the OneNote configuration/templating pipeline for OneNoteSubstrateMSAScope and/or the currently authorized Substrate scope for the OneNote Android MSA client.

Could this please be escalated to the OneNote / OneAuth / ConfigService engineering team rather than treated as a local cache, reinstall, WebView or password issue?

Example correlation:

PII removed

Timestamp:

2026-08-31T21:05:28.000Z

No passwords, cookies, authorization codes, access tokens or refresh tokens were collected during the analysis.

onenote-config-trace-result.txt

Answer 1

(Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.)

Hi, Augusto Moraes

Your testing across two independent Android environments, together with the unresolved OAuth scope and invalid_scope error, strongly indicates an app or service-side authentication configuration issue rather than a device, password, WebView, or cache problem. Similar 9hehw reports are affecting OneNote for Android while notebooks remain available through Windows or the web.

Here are some suggestions you can try:

Please submit the trace through OneNote > Profile picture > Send feedback to Microsoft. Include the app and Android versions, timestamp, error tags 9hehw, 9hk4q, and 9zj08, correlation ID, and the sanitized trace file. This is the appropriate channel for sending diagnostic data to the OneNote product team.

You can also contact Microsoft Support and ask that the case be routed to the OneNote Android authentication team, referencing invalid_scope and OneNoteSubstrateMSAScope.

For now, use OneNote for the web or the notebook list if syncing still works. Avoid reinstalling or clearing app data when any notes are not yet synchronized, as locally stored changes may be lost.

Please be advised that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.   

Thank you for your patience in reading, I hope this information has been helpful to you. 

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment."    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.