Apple Mail EWS sync intermittent after EwsEnabled=True + AppID allow list

We're a small Microsoft 365 Business tenant (Exchange Online Plan 1/2 mix). One user's Apple Mail (macOS, Exchange/EWS account) intermittently stops syncing new mail — Connection Doctor shows a healthy green "Connection and login to server succeeded," but Get New Mail/manual fetch and forced Sync All Accounts return nothing new, while the same mail is already present via ActiveSync on the same user's iPhone/iPad. Symptoms recur every 1–3 days after temporarily resolving.

Troubleshooting completed so far:

- Confirmed autodiscover/External URL correctly resolves to outlook.office365.com/EWS/Exchange.asmx

- Confirmed EWS enabled at the mailbox level (Manage email apps in admin center)

- Found EwsEnabled was blank/null at the org level — set to $true via Set-OrganizationConfig

- Configured EwsAllowedAppIDs to include Apple's app ID (f8d98a96-0999-43f5-8af3-69971c7bb423, "Apple Internet Accounts")

- Fully removed and re-added the Mac Mail account after the above org-level change

- Restarted the Mac, tried DNS changes (8.8.8.8/8.8.4.4), ruled out router-level filtering

- Verified no antivirus/VPN/security software on this Mac's network

Despite all this, the issue persists intermittently. Notably, a second mailbox on the same tenant, used with Apple Mail on a different Mac (different macOS version, different physical location/network), does NOT experience this issue — so it doesn't appear to be a blanket tenant-wide EWS disruption.

Given Apple Mail's continued reliance on EWS ahead of the October 2026 phased disablement, and Microsoft's acknowledgment that Apple Mail for Mac is a heavy EWS consumer they're working with Apple to migrate to Graph, I'm wondering:

1. Could this be related to the ongoing "scream test" EWS disruption testing Microsoft has mentioned, and if so, is there a way to check whether a specific mailbox has been included in that testing?

2. Any known differences in EWS session/connection handling between macOS versions that could explain one Mac being affected and not the other?

3. Anything else worth checking tenant-side (throttling policies, CAS mailbox settings, conditional access rules) that could apply per-mailbox rather than tenant-wide?

Happy to provide EWS usage report data or run any diagnostic commands if it helps others hitting the same thing before October.