onenote-install-auth

name	onenote-install-auth
description	Install and configure OneNote SDK/API authentication with delegated auth (MSAL). Use when setting up a new OneNote integration, configuring Azure AD app registration, or migrating from deprecated app-only auth. Trigger with "install onenote", "setup onenote auth", "onenote credentials", "azure ad onenote".
allowed-tools	Read, Write, Edit, Bash(npm:*), Bash(pip:*), Grep
version	1.6.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","onenote","microsoft"]
compatibility	Designed for Claude Code

OneNote Install & Auth

Overview

Set up Microsoft Graph API authentication for OneNote using delegated credentials via MSAL. This skill walks through Azure AD app registration, SDK installation, permission scope selection, token caching, and connection verification for both Python and TypeScript.

BREAKING CHANGE (March 31, 2025): App-only authentication (ClientSecretCredential) was deprecated for OneNote APIs. All integrations MUST use delegated auth — DeviceCodeCredential or InteractiveBrowserCredential. If your existing code uses ClientSecretCredential with OneNote endpoints, it will receive 403 Forbidden on every call. This skill provides the correct migration path.

Prerequisites

• Azure account with permission to register applications (Azure AD admin or Application Developer role)
• Node.js 18+ or Python 3.10+
• Access to Azure Portal App Registrations
• A OneNote account (personal Microsoft account or Microsoft 365 work/school account)

Instructions

Step 1: Register an Azure AD Application

1. Navigate to Azure Portal > App Registrations
2. Click New registration
3. Set the Name (e.g., onenote-integration-dev)
4. Under Supported account types, choose:
   • Single tenant — only your organization (most restrictive, recommended for internal tools)
   • Multi-tenant — any Azure AD directory (needed if serving multiple orgs)
   • Multi-tenant + personal — includes personal Microsoft accounts (needed if targeting consumer OneNote)
5. Under Redirect URI, select Public client/native and set URI to http://localhost
6. Click Register and note the Application (client) ID and Directory (tenant) ID

Step 2: Configure API Permissions

1. In your app registration, go to API permissions > Add a permission > Microsoft Graph > Delegated permissions
2. Add the appropriate scope:

Scope	Use Case
Notes.Read	Read-only access to user's notebooks