1351 - M365 backup set creation fails with error: "The app needs access to a service"

Symptom

On attempting to create a new backup set for any of the M365 services (Exchange, OneDrive, SharePoint or Teams), the following error presents in the RedApp: "Access denied: The app needs access to a service ('https://*onenote.com/'). Please log in to this service first before creating new backups."

You may also see one or both of the following errors in your browser's developer tools:

Refused to load the script '{scriptPath}' because it violates the following Content Security Policy directive: "script-src {policyPath} 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-lem' was not explicitly set, so 'script-src' is used as a fallback.

The app is trying to access a service ‘{appId}’ ({appName}) that your organization '{organization name}' lacks a service principal for. Contact your IT Admin to review the configuration of your service subscriptions or consent to the application in order to create the required service principal.

Cause

The RedApp requires permissions to the OneNote API in order to protect M365 data. Although OneNote is included in all M365 Business plans, the OneNote service is not auto-linked to a subscription as is the case with Exchange, OneDrive, SharePoint, and Teams. This error will therefore occur even if no user in the Microsoft tenant uses the OneNote service.

Solution

To link the OneNote service to a subscription, a user (any user in the relevant tenant) must log into OneNote, either via the desktop app or via the OneNote web app. It is not necessary to create a notebook or take any further action. Once the service has been accessed, you will be able to create backup sets and authenticate without encountering the above errors.