Hotmail: Oauth2 authentication fails (private microsoft account)

Checklist

• I have used the search function to see if someone else has already submitted the same bug report.
• I will describe the problem with as much detail as possible.

App

Thunderbird for Android

App version

21.1

Where did you get the app from?

F-Droid

Android version

17 (GrapheneOS)

Device model

Pixel

Steps to reproduce

1. Register a hotmail account in TB Android or try using an existing one (in this instance)
2. It gives an error "OAuth signin failed"

3. Press "retry", open in a Vanadium preview window (Chromium-based browser, best compatibility), it gives another useless error "we're unable to complete your request". Same happens when using Ironfox or vanilla Chromium with default settings.

This is the (censored) link it tries to open:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?redirect_uri=msauth://net.thunderbird.android/xxxxxxxxxxx&client_id=xxxxxxxxxxx&response_type=code&login_hint=username@hotmail.com&state=xxxxxxxx&nonce=xxxxxxxxxx&scope=profile openid email https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access&code_challenge=xxxxxxxxxxxx&code_challenge_method=S256

Note
this appears to be multiple links at once, which could explain the issue!

In the browser this gets converted to

https://login.live.com/oauth20_authorize.srf#?client_id=e6xxxxxxxxxx&scope=profile+openid+email+https://outlook.office.com/IMAP.AccessAsUser.All+https://outlook.office.com/SMTP.Send+offline_access&redirect_uri=msauth://net.thunderbird.android/xxxxxxxx+xxxxxx=&response_type=code&state=xxxxxxxxx&nonce=xxxxxxxxxxxx&login_hint=username@hotmail.com&code_challenge=xxxxxxxxxxxxx&code_challenge_method=S256&uaid=xxxxxxxxxxx&msproxy=1&issuer=mso&tenant=common&ui_locales=de-DE&epctrc=xxxxxxxx+xxxxxxxxxx=6:1:CANARY:XXXXXXXXXXX=&epct=xxxxxxxxxxxxxxxx&jshs=0#

4. Instead try and "share" the link to Vanadium in the work profile without VPN etc, there it works and allows to login, but after having logged in, it complains that this method is not available for private accounts

AADSTS500200: User account 'username@hotmail.com' is a personal Microsoft account. Personal Microsoft accounts are not supported for this application unless explicitly invited to an organization. Try signing out and signing back in with an organizational account.

Note: a commercial VPN provider is used for both thunderbird and vanadium. Excluding the apps from the VPN has zero effect.

Expected behavior

Oauth should work? Totally possible that Microsoft just enshittified something here and broke compatibility with 3rd party clients.

Actual behavior

Login fails, link might be broken

The account config appears to be automatically generated

outlook.office365.com
SSL/TLS
993
OAuth 2.0
username@hotmail.com

Logs

Thunderbird log 50d7a1e0a5c4.txt

Start by reviewing the attached Thunderbird log, the generated outlook.office365.com account configuration, and the OAuth authorization URL from the reproduction steps. Determine whether the failure is in Thunderbird’s redirect or account handling or Microsoft’s support for personal accounts; done means documenting the cause and confirming a viable resolution or limitation.