Start with PowerShell commands:
Get-MailboxPermission -Identity "email@example.com"
Make sure the ServiceId returned the same as the Object ID on the Enterprise Application screen (do not use the value from the App Registration screen)
Make sure the AppId is the same as the Application ID on the Enterprise Application screen.
Check if you can connect to this account using IMAP and regular interactive flow:
This proves you have IMAP access properly configured.
Usually people use incorrect client/tenant ids/secrets – double check every single value you enter (also for additional spaces).
You may need to wait 20-30 minutes for some changes to take effect (it really may take this long!).
- there is no need to deactivate MFA in this flow
- there is no need to activate public client flows (App Registrations/Authentication/Allow public client flows) in this flow