Found the answer! I removed the set-payload component and added a body to the http:request component:

<http:request config-ref="HTTP_Request_configuration" method="POST" path="/oauth2/v2.0/token">
    <http:body><![CDATA[#[output application/x-www-form-urlencoded --- {'client_id':'${outlook.client.id}','client_secret':'${outlook.client.secret}','grant_type': 'client_credentials','scope':'https://outlook.office365.com/.default'}]]]></http:body>
</http:request>