AWS WorkMail OAuth 2.0 support

    AWS WorkMail currently does not support OAuth 2.0 authentication. This creates compatibility issues with newer Microsoft clients, particularly the new Outlook 365 client which no longer supports Exchange Basic authentication (which WorkMail uses).

    For your requirements of email, calendars, and contacts synchronization, here are the workarounds:

    1. Use the traditional Outlook desktop client (Office 365 version) rather than the new Outlook 365 client. The traditional Outlook client still supports Basic authentication and works with WorkMail for full functionality including email, calendars, and contacts.

    2. Ensure you're using "legacy mode" if you're on Mac Outlook to fully utilize Amazon WorkMail features. The new Outlook mode lacks support for complete WorkMail profile configuration.

    3. If you must use the newer Outlook 365 client (the replacement for the Mail app in Windows), be aware that it only supports connecting to WorkMail via IMAP/SMTP, which will not provide the calendar and contact synchronization you need.

    4. As an alternative, you can use the WorkMail web client which provides full functionality for email, calendars, and contacts.

    The limitation is due to Microsoft's move away from Basic authentication in their newer clients, while AWS WorkMail has not yet implemented OAuth 2.0 or other modern authentication methods like 2FA.
  

Sources
AWS Workmail incompatibility with Microsofts new Outlook 365 Client | AWS re:Post
Setting up Microsoft Outlook clients for Amazon WorkMail - Amazon WorkMail
WorkMail emails not received in Outlook (Windows desktop), other clients successful | AWS re:Post