App Passwords for IMAP

I have a 1998 Hotmail account that I still use. Today it has evolved to just yet another Microsoft account. 

For many years, I used `getmail` to receive mails from the account, using e-mail and password credentials. Recently microsoft sunsetted this "less secure" login method for IMAP. So following the docs I set up 2FA and created an app password to use for IMAP login instead of the account password.

Unfortunately, the new app password based login keeps failing with

getmail version 6.18.11
Copyright (C) 1998-2023 Charles Cazabon and others. Licensed under GNU GPL version 2.
SimpleIMAPSSLRetriever:email address removed for privacy reasons@imap-mail.outlook.com:993:
email address removed for privacy reasons: credential/login error (b'LOGIN failed.')

The getmail config is actually pretty straight forward:

[retriever] type = SimpleIMAPSSLRetriever
server = imap-mail.outlook.com
username = email address removed for privacy reasons
password = xxxxxxxxxxxx

I am aware that older getmail docs talk about an "xoauth" login method, that requires the e-mail account to be a microsoft developer account (whose registration in turn requires this and that and keeps ending with a strange error popup). However, the Microsoft docs clearly say that with 2FA turned on, all you need is an app password to use "other e-mail clients"

But why doesn't it work? Any ideas?