Authorization flow
smtpify365 uses Authorization Code flow with PKCE and state validation. Microsoft hosts account selection and consent.
Delegated access
Mail is submitted as the signed-in user through `/me/sendMail`; no tenant-wide application Mail.Send permission is requested.
Ongoing access
The offline_access scope permits refresh tokens so a device can send later. Revoke the smtpify365 connection when access is no longer needed.