3450697 - OAuth with Microsoft 365 but the refresh token doesn't work

Customer has a scenario that configured OAuth with Microsoft 365 in CPI. But the refresh token doesn't work with the error:

com.sap.esb.oauth.token.access.TokenAccessException: Problem during reading the access token for the OAuth2 Authorization Code Credential <credential name> from the cache: com.sap.esb.oauth.token.access.TokenAccessException: Access token request via refresh_token grant type for OAuth2 Authorization Code credential '<credential name>' failed after 5 retries: HTTP request failed: {\"error\":\"invalid_grant\",\"error_description\":\"AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance. Trace ID: <***> Correlation ID: <***> Timestamp: ...\",\"error_codes\":[53003],\"timestamp\":\"...\",\"trace_id\":\"<***>\",\"correlation_id\":\"<***>\",\"error_uri\":\https://login.microsoftonline.com/error?code=53003\,\"suberror\":\"message_only\",\"claims\":\"{\\\"access_token\\\":{\\\"capolids\\\":{\\\"essential\\\":true,\\\"values\\\":[\\\"<***>\\\",\\\"<***>\\\"]}}}\"}( HTTP response code: 400, token URL 'https://login.microsoftonline.com/<***>/oauth2/v2.0/token', client Id '<***>', client secret SHA256 hash '***', refresh token SHA 256 hash '***', and scope 'https://outlook.office.com/SMTP.Send')

• SAP Integration Suite
• SAP Business Technology Platform 
• Cloud Integration

SAP Cloud Integration, SAP Integration Suite, CPI, Cloud Platform Integration, HCI, HANA Cloud Integration, AADSTS53003, Conditional Access policies, OAuth, Microsoft 365, HTTP response code: 400, IP. , KBA , LOD-HCI-PI-CON-SOAP , SOAP Adapter , Problem