I have been working on this same thing recently and kept running into the same problem. If you are still having issues, set the MechanismList property of the %Net.Authenticator instance to XOAUTH2 to limit the SASL authentication types the Start method of the authenticator instance looks for when it gets an AUTH response from the SMTP server.

    set smtp = ##class(%Net.SMTP).%New()
    set auth = ##class(%Net.Authenticator).%New()
    set auth.ServiceName = "smtp"
    set auth.UserName = "frodob@theshire.onmicrosoft.com"
    set auth.MechanismList = "XOAUTH2"
    set auth.AccessToken = accessToken
    set smtp.authenticator=auth

ClassMethod Opposite(s1 As %String = "", s2 As %String = "") As %Boolean
{
    write s1_", "_s2_" --> "
    if (($l(s1) '= $l(s2)) || (s1 = "") || (s1'?.1A.A) || (s2'?.1A.A)) { return 0 }
    for cnt=1:1:$l(s1) {
        if (($zabs($a($e(s1,cnt)) - $a($e(s2,cnt))) '= 32)) { return 0 }
    }
    return 1
}

You can use the Create method of the Security.Users class to do that. Bear in mind that class is in %SYS. Documentation for Create is here: Security.Users.

set $nameSpace = "%SYS"
if '##class(Security.Users).Exists("testuser") {
    // Set properties
    set props("Enabled")=1
    set props("Name")=testuser
    set props("FullName")="Test User"
    set props("SuperUser")=0
    set props("NameSpace")="USER"
    set props("Roles")="%Developer,%Operator,TestRole"
    set props("Password")=userpassword
    set props("PasswordNeverExpires")=0
    set props("ChangePassword")=0
    set props("Routine")=""
    set props("ExpirationDate")=""
    set props("Flags")=1
    set props("EmailAddress")=""
    set status=##class(Security.Users).Create(user, .props)
    if $$$ISERR(status) {
        do $system.Status.DecomposeStatus(status, .err)
    }
}