Microsoft Graph report draft

Title: GET /me/notes returns 403 ErrorAccessDenied for a personal Outlook.com account with ShortNotes.ReadWrite delegated consent

I am using a personal Outlook.com/Hotmail Microsoft account. The account has an Outlook Notes folder with a note that is visible both in Outlook on the web and in Apple Notes on iOS. I registered a public client application that supports personal Microsoft accounts and consented to the delegated Microsoft Graph permissions ShortNotes.ReadWrite, ShortNotes.Read, and User.Read.

The Microsoft Graph List notes documentation lists personal Microsoft accounts and ShortNotes.Read / ShortNotes.ReadWrite as supported for GET /me/notes. A newly acquired access token reports the granted scopes https://graph.microsoft.com/ShortNotes.ReadWrite and https://graph.microsoft.com/User.Read.

Reproduction

1. Sign in with the personal account through the /consumers/oauth2/v2.0 device-code flow and request offline_access, ShortNotes.ReadWrite, and User.Read for Microsoft Graph.
2. Send GET https://graph.microsoft.com/v1.0/me?$select=id with this bearer token. It returns HTTP 200.
3. Send GET https://graph.microsoft.com/v1.0/me/notes with the same token. It returns HTTP 403:

   
      {"error":{"code":"ErrorAccessDenied","message":"Access is denied. Check credentials and try again."}}
   
   

4. GET https://graph.microsoft.com/beta/me/notes returns the same HTTP 403 and error.

These were direct HTTPS requests, with no SDK. No note content, access token, account identifier, or refresh token is included in this public report.

Diagnostic request IDs (28 September 2026, UTC)

| Request | Result | request-id | Date header |

| --- | --- | --- | --- |

| GET /v1.0/me?$select=id | 200 | 7a22f47f-7ef1-4a05-a0fc-09cacf6bca86 | Mon, 28 Sep 2026 05:16:27 GMT |

| GET /v1.0/me/notes | 403 | f418d794-3c35-4b26-9fdd-f13070d20da1 | Mon, 28 Sep 2026 05:16:28 GMT |

| GET /beta/me/notes | 403 | f757d39d-ae4f-4688-8f79-3b2607aea133 | Mon, 28 Sep 2026 05:16:29 GMT |

Could the Graph team confirm whether /me/notes is currently enabled for personal Microsoft accounts, and whether an additional account or mailbox requirement applies? If personal accounts are supported as documented, could you investigate why this account receives ErrorAccessDenied despite successful delegated consent? I can provide additional non-public diagnostics through a secure support channel if needed.