Can be rewritten with object-script, but for me it is fine. No external command nor external files. ClassMethods can used for an authorization.

Perhaps Intersystems will be produce a better solution for us...

Got EnsLib.EMail.InboundAdapter and added some line using AccessToken[Name]. Embedded Python code based on mutt_oauth2.py I have stripped it a little (only 'authcode'-flow) Elliminate external file and using IRIS-globals. Put 'client_id', 'client_secret', 'tenant' from registrations to token (saved in global) to be independent from edit sourcecode like mutt_oauth2.py was.

To use OAuth2 you have to start with getting an URL for authentication process:

w ##class(My.EnsLib.EMail.OAuth2InboundAdapter).askAuthorization(AccessTokenName, registration, mail, clientid, clientsecret [,tenant])

registration meens the name of the python 'registrations'-Array-Element.  The output is an URL to use in browser for getting an authorizationCode. After login and some confirmations you get a code. On google you find it much clear in a well styled webpage. On microsoft you find the code as part of the destination url in browsers url textfield.

w ##class(My.EnsLib.EMail.OAuth2InboundAdapter).doAuthorization(AccessTokenName, AuthorizationCode)

returns the first AccessToken and saving all details on ^OAuth2.AccessToken(AccessTokenName) global.

now you are ready to retrieve mails by oauth2.

Class My.EnsLib.EMail.OAuth2InboundAdapter Extends Ens.InboundAdapter [ ClassType = "", ProcedureBlock, System = 4 ]
{
...
Method OnTask() As %Status
{
...
            If '$IsObject(..%CredentialsObj) Do ..CredentialsSet(..Credentials) If '$IsObject(..%CredentialsObj) { Set tSC=$$$EnsError($$$EnsErrNoCredentials,..Credentials) Quit }
            Set tAccessToken=""
            Set:..AccessTokenName'="" tAccessToken=..getAccessToken(..AccessTokenName)
            If $FIND(tAccessToken,"ERROR:") = 7 {
                $$$LOGERROR(tAccessToken)
                Set tAccessToken=""
            }
            Set:tAccessToken="" tAccessToken=..AccessToken
            $$$TRACE("tAccessToken="_tAccessToken)
            Set tSC = ..MailServer.ConnectPort(..POP3Server,..POP3Port,..%CredentialsObj.Username,..%CredentialsObj.Password,tAccessToken)
...
}

ClassMethod getAccessToken(pTokenName As %VarString) As %VarString
{
    Quit ..OAuth2Method(pTokenName)
}

ClassMethod askAuthorization(pTokenName As %VarString, pReg As %VarString = "", pMail As %VarString = "", pClientId As %VarString = "", pClientSecret As %VarString = "", pTenant As %VarString = "") As %VarString
{
    Quit ..OAuth2Method(pTokenName, 1, pReg, pMail, pClientId, pClientSecret, pTenant)
}

ClassMethod doAuthorization(pTokenName As %VarString, pAuthCode As %VarString = "") As %VarString
{
    Quit ..OAuth2Method(pTokenName, 1, , , , , , pAuthCode)
}

ClassMethod OAuth2Method(pTokenName As %VarString, pDoAuth As %VarString = "", pReg As %VarString = "", pMail As %VarString = "", pClientId As %VarString = "", pClientSecret As %VarString = "", pTenant As %VarString = "", pAuthCode As %VarString = "") As %VarString [ Internal, Language = python, Private ]
{
#   based on mutt_oauth2 https://github.com/muttmua/mutt/blob/master/contrib/mutt_oauth2.py
}