Agentic Fabriq
Microsoft OneNote
DOCS & KNOWLEDGE · TASKS
Notebooks, sections and pages read and written as the person the agent acts for.
Connect Microsoft OneNote with Fabriq Developer
Your user consents at Microsoft OneNote. The credential lands in a vault your agent cannot read, and the tool list it gets back is the intersection of that user’s grant and the agent’s own scopes.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting Microsoft OneNote in practice
The OneNote API in Microsoft Graph does not support app-only authentication, so an unattended agent cannot hold a tenant token of its own — it has to act as a signed-in user, and the two scopes that reach other people’s notebooks both require admin consent. Throttling is 120 requests a minute and 400 an hour per app per user, with five concurrent requests and no Retry-After header on 429.
Scopes that draw scrutiny
Notes.ReadWrite.AllRead and write all OneNote notebooks. Requires admin consent as a delegated permission, not only as an application one.Notes.Read.AllRead all OneNote notebooks. Also requires admin consent in the delegated flow, which surprises teams who picked read-only to avoid a review.Notes.ReadWriteRead and write the signed-in user’s notebooks. No admin consent, and the widest grant a user can approve alone.Notes.ReadWrite.CreatedByAppLimited access to OneNote notebooks, covering only what the app itself created — the narrow option, and too narrow to find an existing page.
Rate limits
- Per app per user (delegated context): 120 requests per 1 minute and 400 per 1 hour.
- Concurrent requests: five per app per user.
- Published app-only figures of 240 per minute and 800 per hour exist in the throttling table, but the OneNote API does not support app-only authentication.
- Microsoft Graph additionally caps any app at 130,000 requests per 10 seconds across all tenants.
Who has to approve
Notes.Read.All and Notes.ReadWrite.All require admin consent in both the delegated and application contexts, so a tenant administrator has to grant them before any user can connect with them. Notes.Read, Notes.Create and Notes.ReadWrite do not.
Worth knowing
- OneNote resources do not return a Retry-After header on 429, so backoff has to be guessed rather than obeyed.
- The 400-per-hour ceiling is the binding one: it works out to under 7 requests a minute sustained, well below the 120-a-minute burst figure.
- Notebooks live at four different roots — /me, /users/{id}, /groups/{id} and /sites/{id}/onenote — so a group or SharePoint team notebook is a different URL shape, not a parameter.
- The beta endpoint carries features the docs explicitly advise against using in production, and the v1.0 surface is the only stable one.
Checked against Use the OneNote REST API (2026-09-29), Microsoft Graph permissions reference (2026-09-29), Microsoft Graph throttling limits (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Microsoft OneNote behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.