Permissions for Flatpak for M365 Intune Auth

I'm now testing 3.60.2, but I noticed some inconsistency.
- After adding an M365 account protected by intune installed on the system, I was immediately presented by a message stating "OAuth2 secret not found”.
-If I click reconnect, I'm presented with an authentication browser window. This window does not help for authentication as it is not a Microsoft Edge window (ie for conditional access). Evolution's own browser windows cannot auth with Office365 servers protected by Intune.
- If I click Copy URL or open in Browser and it opens in Edge, I can copy back the authenticated URL (before it gets redirected!), it accepts, but then presents another OAuth2 secret not found.

Then I gave permission to talk to Session Bus: com.microsoft.identity.broker1
Tthis time, It connects w/o asking anything.

I then deleted all settings & Accounts and removed flatpak folders, re-run Evolution, this time with the session bus access already there, I setup my account, I'm again presented by a "OAuth2 secret not found" error, but when I do re-connect and authenticate, it works.

Here are my questions:
- Should the above talk permission be standard in the flatpak installation? Users may not know they need it?
- The Himmelblau project which implemented the M365 Intune authentication functionality for Evolution 3.53.2+, states in the below document that (https://himmelblau-idm.org/docs/mail_integration/)

```
**Authorizing Evolution**
You may see an error immediately after clicking Apply. This is expected. A dialog will appear asking you to authorize Evolution.
Click to open the connection / authorization dialog. You will be redirected to the Office 365 login authorization page.
**You will not be asked for your username or password. Himmelblau automatically provides authentication.**
You will be asked to confirm that Evolution is allowed to access your account.
Approve the authorization. Once authorized, Evolution will connect normally and begin syncing your mailbox.
```
so I expected Evolution to present me the existing accounts in the system instead of asking for my username and password in an auth window (ie after querying the microsoft identity broker for accounts present on system), then proceed for my authentication to authorizate the app.

Just wondered if anything is still missing in the auth workflow wrt to Identity Broker 3.0.2, or if this is the intended behavior. (himmelblau implementing an intune compatible device authentication layer, other apps like Chrome or thunderbird can use it to auth to Intune and Himmelblau interchangably).