Microsoft Graph Sticky Notes API returns 403 ErrorAccessDenied despite ShortNotes.ReadWrite consent

The /v1.0/me/notes call is officially documented as supporting personal Microsoft accounts with delegated ShortNotes.Read or ShortNotes.ReadWrite, so this correctly scoped 403 ErrorAccessDenied should be escalated as a Microsoft Graph service or documentation issue rather than worked around by adding permissions.

What the documentation currently says

• GET /me/notes supports delegated personal Microsoft accounts. ShortNotes.Read is sufficient for reading, and ShortNotes.ReadWrite is also accepted. Application permissions are not supported.^1^
• ShortNotes.ReadWrite is available for personal Microsoft account consent, does not require administrator consent, and permits reading, creating, editing, and deleting the signed-in user’s short notes.^2^
• Updating a note likewise documents delegated ShortNotes.ReadWrite support for personal accounts; application access remains unsupported.^3^
• The documented API is already available in v1.0, so switching to /beta is neither required nor expected to bypass an authorization failure.

Your successful /me call only proves that the token and User.Read path work. However, because you have already confirmed that the delegated token contains ShortNotes.ReadWrite, repeating consent or adding admin consent is not an applicable fix for this personal-account case.

A recent Microsoft Q&A report describes the same combination—personal Outlook.com account, delegated ShortNotes.ReadWrite, and GET /me/notes returning 403 ErrorAccessDenied—but currently has no accepted or recommended resolution.^4^ The public Graph known-issues page also does not document a Sticky Notes incident or workaround.^5^

Consequently, the available public information cannot confirm whether this is a temporary incident, a personal-account rollout restriction, or a documentation defect. It does establish that the observed behavior conflicts with the published endpoint contract.

Supported workaround

There is currently no documented alternative Graph endpoint for reading and updating these Notes-folder objects:

• /me/profile/notes is a different API returning profile personAnnotation objects; it is not an alternative Sticky Notes endpoint.
• Application/client-credentials access is unsupported for Notes.
• Direct access to undocumented Outlook or Sticky Notes synchronization endpoints would not be a supported workaround.
• Continuing to use Outlook.com or the Windows Sticky Notes client preserves supported interactive access, but does not provide an API integration path.

If service access is restored, the supported update operation is:

PATCH https://graph.microsoft.com/v1.0/me/notes/{note-id}
Authorization: Bearer {delegated-access-token}
Content-Type: application/json
If-Match: "{changeKey}"

{
  "subject": "Updated note",
  "body": {
    "contentType": "text",
    "content": "Updated content"
  }
}

Microsoft recommends If-Match with the note’s changeKey to prevent overwriting a concurrent update.^3^

Escalation information to provide

Open a Microsoft support case or continue the directly matching Q&A report with:

1. The UTC response date.
2. Graph request-id and your unique client-request-id.
3. The app/client ID, but not the access token or secrets.
4. Confirmation that this is a delegated personal Microsoft account.
5. The requested URL and method.
6. A redacted token-claim summary showing:
   • Graph audience (aud)
   • scp containing ShortNotes.ReadWrite
   • account/tenant-identifying claims redacted
7. The full response body and response headers.
8. A minimal reproduction showing that /v1.0/me succeeds while /v1.0/me/notes fails.

Microsoft’s Graph debugging guidance specifically recommends sending and logging a unique client-request-id, plus retaining the response request-id and date because those values are needed by Microsoft Support to correlate the backend request.^6^

Since your supplied request identifiers and timestamp already satisfy the key correlation requirements, retain them exactly as returned. They are the most useful next step for determining whether the backend rejected the account because of an undeclared restriction or a service defect.

References

1. List notes
2. Microsoft Graph permissions reference
3. Update note
4. GET /me/notes returns 403 ErrorAccessDenied for a personal Outlook.com ...
5. Known issues in Microsoft Graph
6. How to debug Microsoft Graph API calls