Answer
Beyond the host/port/scope settings, make sure the mail sender configuration has the Secret, Application (Client) ID, and specifically the v2 OAuth 2.0 Token Endpoint filled in correctly — using the v1 token endpoint, or a mismatched Application ID/Secret pair from the Azure app registration, is a common cause of the token retrieval itself failing before it ever gets to sending mail.