As @kamil mentioned, there was a notable Microsoft deprecation that recently came into full effect. The TLDR; is:

WS-Trust authentication type that is used by custom clients to connect to Dataverse is deprecated. We are making this change to remove a security protocol (WS-Trust) that is inherently insecure by current encryption standards.

Effective April 2022, the authentication protocol will be retired for all new and existing environments within a tenant. The retirement of new environments starts April 1, 2021 and rolls out gradually in all regions within a 6-week window.

More info can be found here.

Sitecore released fixes for this in Sitecore Connect for Microsoft Dynamics 365 for Sales 7.0.0 (release notes), and after speaking with Sitecore support, they provided a hotfix for version 4 (Hotfix 500295).

Regarding hotfixes, the usual warning applies:

The hotfix was built specifically for Sitecore Dynamics CRM connector 4.0 and you should not install it on other Sitecore versions or in combination with other hotfixes, unless explicitly instructed by Sitecore Support.

For this hotfix, I would recommend manual installation rather automatically installing the .zip.

After applying the hotfix, I was able to connect to the D365 instance with this connection string format:

AuthType=ClientSecret;ClientId=xxxxxxx;ClientSecret=xxxxxxx;Url=https://ORG_NAME.api.crm.dynamics.com/;

As far as I can tell, this is the best-practice method of connecting to an organization with 2FA/MFA enabled. See this Microsoft guide to learn more about best practices for authentication.

After applying the hotfix, I did run into other connection string issues when running a pipeline batch: CRM ConnectionString cannot be null or empty. I will post updates as I receive them.

Regarding the log location of the connection troubleshooter errors, I can confirm that if you want to see the full stack trace, you must write your own Sitecore.DataExchange.Providers.DynamicsCrm.Endpoints.OrganizationEndpointTroubleshooter and specify it as the Troubleshooter type on the Dynamics Organization Endpoint item.

As @kamil mentioned, there was a notable Microsoft deprecation that recently came into full effect. The TLDR; is:

WS-Trust authentication type that is used by custom clients to connect to Dataverse is deprecated. We are making this change to remove a security protocol (WS-Trust) that is inherently insecure by current encryption standards.

Effective April 2022, the authentication protocol will be retired for all new and existing environments within a tenant. The retirement of new environments starts April 1, 2021 and rolls out gradually in all regions within a 6-week window.

More info can be found here.

Sitecore released fixes for this in Sitecore Connect for Microsoft Dynamics 365 for Sales 7.0.0 (release notes), and after speaking with Sitecore support, they provided a hotfix for version 4 (Hotfix 500295).

Regarding hotfixes, the usual warning applies:

The hotfix was built specifically for Sitecore Dynamics CRM connector 4.0 and you should not install it on other Sitecore versions or in combination with other hotfixes, unless explicitly instructed by Sitecore Support.

For this hotfix, I would recommend manual installation rather automatically installing the .zip.

After applying the hotfix, I was able to connect to the D365 instance with this connection string format:

AuthType=ClientSecret;ClientId=xxxxxxx;ClientSecret=xxxxxxx;Url=https://ORG_NAME.api.crm.dynamics.com/;

As far as I can tell, this is the best-practice method of connecting to an organization with 2FA/MFA enabled. See this Microsoft guide to learn more about best practices for authentication.

After applying the hotfix, I did run into other connection string issues when running pipeline batches. I saw this error in the job logs: CRM ConnectionString cannot be null or empty. The way I fixed the issue was by creating a new tenant AFTER applying the hotfix.

Regarding the log location of the connection troubleshooter errors, I can confirm that if you want to see the full stack trace, you must write your own Sitecore.DataExchange.Providers.DynamicsCrm.Endpoints.OrganizationEndpointTroubleshooter and specify it as the Troubleshooter type on the Dynamics Organization Endpoint item.