That's the point: this isn't OAuth. It's just a way to phish the code.
If it is not oAuth, where does Microsoft come from then?