[neomutt-users] OAUTH2 via oama without device code flow?

[Peter P.]

Hi list,

I struggling, like possibly many others, to get mutt and mbsync to fetch
emails from microsoft accounts with (X)OAUTH, especially now that admins
are disabling "device code flow" for security reasons. I want to keep
local copies of my emails rather than have mutt connect directly to the
server.

So far I have used mutt with mbsync with oauth2ms[1], with in .mbsyncrc
	PassCmd oauth2ms
	AuthMechs XOAUTH2
with tenant_id and client_id specified in ~/.config/oauth2ms/config.json

or alternatively with oama[2], as it permits using different accounts:
	PassCmd "oama access user at domain"
	AuthMechs XOAUTH2
with a thunderbird client_id specified in ~/.config/oama/config.yaml as
	microsoft:
	client_id: 9e5f94bc-e8a4-4e73-b8be-63364c29d753

To authorize oama I was using the "device code flow"
	oama authorize microsoft user at domain --device
which sent me to a webpage where I made a 2FA login via a hardware
security USB key.

But several admins are now disabling the "device code flow" for security
reasons and I can no longer authorize, getting an error described in
https://github.com/harishkrupo/oauth2ms/issues/9

Do I require client_{id,secret} values from these admins to
authorize oama without device code flow? What if I can't get those
values from the admins?

Why does all this work with Thunderbird without getting
client_{id,secret} values?

How are others using mbsync with microsoft institutional accounts but
without "device code flow"?

Thanks for any help!
Peter

[1] https://github.com/harishkrupo/oauth2ms
[2] https://github.com/pdobsan/oama