Are you using defender for o365? If so, usually uou can get a copy of Any rejected messages at security.microsoft.com and get more info from the message explorer

can you drop the header in here: https://mha.azurewebsites.net/pages/mha.html

it might have some more info for you

I’ve been using my selfhosted mailserver on a cheap VPS for a few years with no issues. It took about a week to get DMARC/DKIM/SPF setup right, and then a few back and forth email threads to my email addresses hosted on gmail, yahoo, and M365 allowed me to gain trustworthy status with them.

mind you, I’m the only user of my mailserver, so I’m not worried about other users spamming and getting me on a list.