Take the owner back from Microsoft and finish connecting the mailbox

Microsoft sends the browser here. The state must be one this deployment signed, for this person, within ten minutes. The code is exchanged for tokens, the address Microsoft says the owner signed in as must be the mailbox’s own, and both mail servers must accept the access token before anything is stored. The refresh token is then sealed where no endpoint can read it back, and the mailbox starts connecting. Whatever happens, the browser is sent back to Messages with signin naming the outcome.