The suggestion from MS was to delete the account and add it again as an Exchange rather than an Outlook account. Naturally this didn't work, because the certificate wasn't recognised as valid. So it went back as an Outlook account.