IMAP OAuth Regression: "User is authenticated but not connected" after successful token validation

I'm reporting a regression in IMAP OAuth authentication for consumer Outlook.com accounts that started recently.

ISSUE SUMMARY:

IMAP connections fail immediately after successful OAuth authentication. The server accepts the OAuth token but returns a BAD response to the NAMESPACE command with the error: "User is authenticated but not connected."

WHAT CHANGED:

• This was working correctly until recently (approximately early-to-mid December 2024)
• No changes were made to my client code or OAuth configuration
• Same implementation that worked before now fails consistently

TECHNICAL DETAILS:

Authentication Endpoint: https://login.microsoftonline.com/common

OAuth Scopes:

• https://outlook.office.com/IMAP.AccessAsUser.All
• https://outlook.office.com/SMTP.Send
• https://outlook.office.com/POP.AccessAsUser.All
• offline_access

IMAP Server: outlook.office365.com:993

Account Type: Consumer Outlook.com (personal Microsoft account)

ERROR SEQUENCE:

1. OAuth token acquisition - SUCCESS
2. IMAP TLS connection established - SUCCESS
3. OAuth AUTHENTICATE command - SUCCESS (token accepted)
4. NAMESPACE command - FAILS with "BAD User is authenticated but not connected"

ERROR MESSAGE:

The IMAP server replied to the 'NAMESPACE' command with a 'BAD' response: User is authenticated but not connected.

WHAT THIS MEANS:

The IMAP server is accepting my OAuth token for authentication but then refusing to establish an authenticated session for subsequent IMAP protocol commands. This makes IMAP completely unusable despite having valid OAuth tokens.

IMPACT:

All IMAP operations fail. Users cannot access their email via IMAP despite successful OAuth authentication.

ROOT CAUSE:

This appears to be a server-side regression in Microsoft's IMAP service - specifically in how authenticated sessions are established after OAuth validation. The client implementation is correct and follows Microsoft's documented OAuth patterns.

REQUEST:

Please investigate recent changes to the IMAP service authentication flow. Something changed on Microsoft's backend that broke the connection between OAuth token validation and IMAP session establishment.