Hi Martin,
I don't think that the LTI protocol would allow for authentication through Microsoft 365. It's supposed to be the tool platform (your virtual learning environment) authenticates the student, which in your case would be through Microsoft 365, and then passes a token representing that student to the tool (Numbas). The tool shouldn't do any authentication. So it's not clear to me at what point your students are being asked to authenticate, or what we can do about it.
Would you mind sending me a private email to
num...@ncl.ac.uk describing in more detail what the problem is?
Christian