Announcing OAuth 2.0 Client Credentials Flow support for POP and IMAP protocols in Exchange Online

Debra_P 
"unauthorized" is better than "bad request", isn't it? I assume you got the 401 when you request the token? 

If you set up the AD application correctly, your client need to have are  the correct values for:
clientId

clientSecret

tenantId

authority =  "https://login.microsoftonline.com/" + tenantId

scope = "https://outlook.office365.com/.default"

Here is a snippet from a working c# code:

IConfidentialClientApplication app;
app = ConfidentialClientApplicationBuilder.Create(clientId)
.WithClientSecret(clientSecret)
.WithAuthority(authority)
.Build();

string[] scopes = new string[]
{
scope,
"offline_access"
};

try
{
token = app.AcquireTokenForClient(scopes).ExecuteAsync().Result.AccessToken;
//Console.WriteLine(decodedToken(token));

}