We weren’t writing the scope “IMAP.AccessAsUser.All” correctly. It should be always followed by Outlook URL. Like this: https://outlook.office.com/IMAP.AccessAsUser.All
SuiteCRM documentation is correct. We were confused by the indication in Azure Admin site: