After beating my face against the OAuth API of Microsoft for an eternity, I finally got OAUTH2 tokens to work. However, when I enable Email Fetching, and the system attempts to IMAP AUTHENTICATE, it fails to AUTHENTICATE and therefore can't pull emails. Which sounds like a Bug.
It's using a token that expires in an hour, I'm not sure if that token expired, or if the MS365 side of things for the given user mailbox is a problem, has anyone else encountered this and have a solution to this? Note we don't seem to ahve a way to 'forget' the last OAuth token in case that got invalidated by MS for some reason.