Files & storage
Set up Microsoft OneNote
Bring your OneNote notebooks in — each page becomes a searchable document, tied to its notebook and section. Microsoft offers no app-only door to notebooks (they are always read as a signed-in user), so this source runs on a refresh token minted once against your company's own Entra app. IT does the whole thing in about ten minutes.
Create the app (IT, once)
- Entra admin center (entra.microsoft.com) → App registrations → New registration — any name, single tenant.
- On the Authentication tab enable “Allow public client flows”.
- Under API permissions add the DELEGATED Microsoft Graph permissions Notes.Read.All, User.Read and offline_access.
- Copy the Application (client) ID from the Overview page.
Mint the refresh token
- Request a device code: POST https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode with client_id=<the app's ID> and scope=offline_access User.Read Notes.Read.All (any HTTP tool — curl -d works).
- Open microsoft.com/devicelogin, type the code from the response, and sign in as an account that can read the notebooks.
- Exchange it: POST the same address with /token instead of /devicecode, grant_type=urn:ietf:params:oauth:grant-type:device_code, the same client_id, and the device_code from step 1 — the response carries the refresh_token.
- Documents → Microsoft OneNote: paste the client ID and the refresh token, optionally restrict to one notebook by name, choose access groups, Test, then Sync.
Read-only. The refresh token renews itself on every sync (each rotation is stored automatically), so it keeps working until that account's password is reset or its sessions are revoked — mint a new one the same way if that happens. Pages come in as their formatted content; the notebook and section become the document's breadcrumb so it sits alongside everything else about that team.
Last updated 29 Aug 2026