Removed: nothing. The stolen tokens carried access to mail and other resources on their own, with no password and no MFA step to satisfy.
Outcome: access to emails and other resources “without needing passwords or MFA”.
The 2020 Microsoft OAuth attack used stolen OAuth tokens to access emails and other resources without needing passwords or MFA. A token that keeps working after the password changes is a standing permission grant with a long tail, and nothing in the login flow reaches it.
Source: Microsoft, Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack (18 December 2020)