Basically, workaround in my case is possible:
I do not need to send notifications outside my domain. Helpdesk works only for doamin.com users.
Microsoft allows to send e-mails from “false” email/aliases to domain.com recipients via domain “smarthost” (domain-com.mail.protection.outlook.com) without auth, you need only helpdesk ip address in domain.com spf1 record.
Problem with e-mail notifications wizard in Zammad - it sends test email to xxx@zammad.org and Microsoft does not pass such e-mail.
@MrGeneration, can you provide console command to setup E-mail notification with following values: SMTP, domain-com.mail.protection.outlook.com, 25, nossl ?