401 Unauthorized on Graph and OneNote API after getting token succesfully - azure-active-directory

Question

I've registered an native app on Azure Active Directory and given all permissions for Graph and OneNote APIs, obtaining tokens succesfully on behalf of users using username and password credentials. I've been able to create and update notebooks and perform other actions on graph using those tokens, but they suddenly stopped working despite no changes to the code making those requests.
I can still do other changes such as creating list items on SharePoint, but any action regarding OneNote notebooks result in 401 with the following response:
{
"error": {
"code": "40001",
"message": "The request does not contain a valid auth token.",
"innerError": {
"request-id": "472a74fd-c050-495a-9ec3-04d1ec3c4461",
"date": "2018-06-26T20:49:28"
}
}
}
I've confirmed the app registration has every permission on both Graph and OneNote APIs
I've confirmed tokens are being requested for the correct resource. In fact I was using Graph, switched to the OneNote API after this problem showed up on Graph, and after a while the same problem happened on OneNote API as well.
I've tried using .NET ADAL AuthenticationContext.AcquireTokenAsync(resource, ClientId, userCredential) or making the request directly to https://login.windows.net/{tenantId}/oauth2/token with the following body and both had the same result
"resource=" + resource
+ "&client_id=" + ClientId
+ "&grant_type=password"
+ "&username=" + Username
+ "&password=" + Password
+ "&scope=openid";
I've tried accessing a notebooks from a SharePoint site open to all users on the tenant and got the same issue, I've tried creating OneNotes on the user personal onedrive and got the same issue, so it's not an issue of the user not having access to the notebook
So, I've made a few dozens of thousand calls on Graph API, then this problem showed up. Another few dozens of thousand calls on OneNote API then this problem showed up. Any ideas of what could be going on? Is there a limit to the number of actions regarding OneNotes that can be made in these APIs?
EDIT : There's two other things I've discovered that are worth mentioning.
The first is that the Graph Explorer was still working normally even while my tokens weren't. I assume the explorer uses authorization code flow to get tokens on behalf of users while I'm using username/password, so the username/passwords authorization flow probably has something to do with the issue. The second thing is that today the Graph API is once again working for OneNote endpoints, which means my app has likely been locked out of making OneNote actions for a time period (24h maybe?)

Answer 1

This also happened to us, I have modified the authentication to below and this authenticates successfully.
$body = "grant_type=client_credentials&client_id=CLIENTID&client_secret=CLIENTSECRET=&resource=https%3A%2F%2Fonenote.com%2F"
$auth = Invoke-RestMethod -Uri 'https://login.microsoftonline.com/TENANTNAME.onmicrosoft.com/oauth2/token' -Body $body -Method post -ContentType application/x-www-form-urlencoded
$accesstoken = $auth.access_token
Just make sure the client id is encoded as it will throw an error if not.