Shout out to davmail, an IMAP proxy that sits between mutt (or any other IMAP client) and Outlook365.
Davmail handles Outlook’s Modern Authentication, and launches a browser when a 2FA challenge/response is required. The latest version of davmail can cache authentication keys meaning you only have to go through 2FA once.
It’s been a real joy to return to mutt, in my latest job where Outlook is deployed, after years of using Gmail.