It looks like the users who are forced to use MS Exchange hosted on Microsoft servers with disabled IMAP and all forms of password authentication, have a usable solution that works on systems other than Windows.
Evolution can be configured to interact with EWS in a sane manner, and it properly supports the dreaded OAuth2.
While
this procedure existed for a while, only today I have encountered a need to configure Microsoft's "application" to get access to my email. Either Microsoft or employer's IT department made another switch away from open standards to the "open" ones, and so I had to "learn" yet another "technology" that is actually a form of obfuscation. Thunderbird and K-9 are unlikely to work with this any soon, however Evolution works.