We have noticed that when you start using OneNote you must have a personal MS account to log into. You then can attach a corporate profile/account to OneNote to access O365 OneNote files in SharePoint/Lync/OneDrive Pro/ etc. While at the business level we can set basic password security criteria. We have no control over the personal password strength. Once these accounts are 'linked' then they remain linked. As such a compromise of a personal account also gives access to the corporate account.
How do we manage this at a corporate level?
Why can we simply not use the corporate account alone for OneNote?