I can't 100% confirm the every 3 months for MS accounts, but it sounds right. The reason it's hard for me to confirm that is (a) I'm always testing accounts so I can't remember when I last did it for a particular account in a particular configuration and (b) having to re-oauth isn't a memorable experience for me since I allow my browser to save my login (meaning: if I didn't do that, then it would certainly be more exasperating and I would probably pay more attention to how often it really happens; as it is, it's just something I have to do every ~3 months and takes ~10 seconds for each outlook account).
Why is it happening? You'd have to ask Microsoft. My guess is that they want to ensure that the user logging in is legitimate. Probably proprietary reasons, too.
Is there anything you can do? You can use an app password instead:
https://support.microsoft.com/en-us/acc ... f2979a7944
G**gle should take note of MS's guide. On the flip side, it looks like for MS app-passwords, you can't name them and if you want to delete one app-password, you have to delete all app-passwords.
I'm pretty sure that Yahoo used to require re-oauth2 at about the same frequency. I don't think they do anymore (but again, the explanation above clouds my memory). fwiw.