Accessing onenote via API MS graph

I've read lots of docs and different posts, but I can't get the right access token to read my own OneNote via api.

• I have MS account and app in azure portal.
• In graph-explorer I CAN read my OneNote.
• If I copy access token from graph-explorer, then my code works fine.

BUT:

• If I request access token from https://login.microsoftonline.com/{tried 'common' or my tenant_id here}/oauth2/v2.0/token, then it does not work:

The OAuth token provided does not have the necessary scopes to complete the request. Please make sure you are including one or more of the following scopes: Notes.ReadWrite.All,Notes.Read.All

• I created app in azure portal and gave it all read permissions, which I found ( for both one-note and ms graph APIs, both delegated and application... just for test) and generated secret
• I'm trying following request:

token_request_data = {
    'client_id': 'id from my app',     # also tried 'common'
    'scope': 'https://graph.microsoft.com/.default',  # other scopes cause errors
    'client_secret': 'secret from my app',
    'grant_type': 'client_credentials'
}

Perhaps somebody could give me a clue what I'm doing wrong ? :)

Sample request via graph explorer: https://graph.microsoft.com/v1.0/users/{my_username}@outlook.com/onenote/sections

Permissions in app (azure portal) screenshot

Permissions in graph explorer screenshot

Notes.Read.All and Notes.readWrite.All are valid for Work or school accounts only. Please refer this document.