For O365 your site admin can revoke permissions for unrecognised client bindings, IMAP and SMTP. If their AUP policy is "only authorised devices, no BYO" then this kind of thing can be blocked.
There are some paths out, the defensive walls here aren't terribly high if you can source the right client sw identity to assert, but that probably isn't honouring the spirit of the AUP.
