Your comments

Any ideas what the reply URL should be for Office 365 OAUTH?

+1 for this. Easy encryption of the web interface should be pretty standard now where remote access is used.