OptionalAllowedGate 2: Optional comma-separated list of permitted corporate email domains (e.g., "company.com,sub.company.com").
OptionalAllowedGate 3: Optional list of permitted Azure AD Tenant IDs (tid) or Google Workspace hosted domains (hd).
Gate 1: Admin must explicitly enable Posture 3 per-user delegated OAuth.
OptionalClientOptionalRevocation
Admin-configured Posture 3 OAuth 2.0 (
3LO) policy for a communication provider.