"advanced security". It doesn't allow app passwords. At least, that used to be the case. Using security keys.

I assume that's oauth2 (which xoauth2 implies). It works for me with O365 and a Duo key for multiple clients.

Thanks for the pointer! I'll have to see if I can get that working. Last I looked at this stuff, I didn't understand oauth as well as I do now. (Which, I'm sure is still not perfect. Is an improvement, though.)

Edit: Am I correct that I have to basically make my own app in order to do this? (Ok if the case, just making sure I'm not looking in the wrong direction.)

I think you're meant to make your own app, but I don't have permission anyway. Some applications have their own tenant id (?) and you can copy, e.g. davmail's from ~/.davmail.properties, or even copy the token you get from it to use with something else.