Then you change authentication credentials on the server.

I'm marking this to keep it hidden so that others will not immediately go perusing the source code looking for the client secret. I'm recommending an expedient review of this bug for the sake of security. A malicious application can impersonate Thunderbird by using this client secret. The current implementation requires Thunderbird to have its Azure App Client Secret hard coded into the source which anyone has access to. Thunderbird is a desktop application that cannot reasonably be expected to protect secrets, and therefore Microsoft has advised that the Azure App should be reconfigured as a public client, and not use client secrets. The Thunderbird Azure App which is used in the implementation of Thunderbirds Office365 OAuth2 authentication uses a confidential client configuration that is designed for protected services/daemons which are usually on protected platforms that can reasonably be expected to protect secrets.

What came out of our joint investigations is summarized below: I spent several months troubleshooting with Microsoft. Thunderbird using Office365/OAuth2 will not observe Microsoft Azure Conditional Access policies, and therefore survive off-network connections as well as password changes.

Mzla technologies corporation