How to access another user's data via the Graph API?
<p>Using the Graph API and related authentication/authorization flows, how can I access data of all users in an organization? Also, multiple organizations/tenants need to be able to use the app.</p>

<p>As an example: I have an app which needs to read events from all calendars of all users under contoso.onmicrosoft.com. I would like that jack@contoso.onmicrosoft.com, the administrator, authorizes the app which will then be able to read the mentioned the data. Using the Managed API this can be easily done via impersonation.</p>

<p>However, I am trying to do the same with Graph API and OAuth, but I can't find a straight forward solution, or I must be missing something very obvious. I have created an app through manage.windowsazure.com (multi-tenant), and configured it so that it requires Microsoft Graph API (all application and delegated permissions).</p>

<p>I did the following:</p>

<p>1) Point jack@contoso.onmicrosoft.com towards <code>https://login.microsoftonline.com/common/oauth2/authorize?response_type=code&amp;redirect_uri=&lt;my redirect url&gt;&amp;client_id=&lt;my client id&gt;</code></p>

<p>2) Jack authorizes the app</p>

<p>3) I get back: <code>&lt;my redirect url&gt;/?code=&lt;my authorization code&gt;&amp;session_state=&lt;blah&gt;</code></p>

<p>4) I send a POST request like below:</p>

<pre><code>POST https://login.microsoftonline.com/common/oauth2/token
Headers: content-type: application/x-www-form-urlencoded

Body:
grant_type=authorization_code&amp;code=&lt;my auth code from step above&gt;
&amp;redirect_uri=&lt;my redirect url&gt;
&amp;client_id=&lt;my client id&gt;
&amp;client_secret=&lt;my client secret&gt;
&amp;resource=https%3A%2F%2Fgraph.microsoft.com%2F
</code></pre>

<p>5) When I do the following:</p>

<pre><code>GET https://graph.microsoft.com/v1.0/users/jack@contoso.onmicrosoft.com/messages
Headers: Authorization: Bearer &lt;auth token from step #4&gt;
</code></pre>

<p>I get a 200 OK response with the messages.</p>

<p>When I do the following:</p>

<pre><code>GET https://graph.microsoft.com/v1.0/users/anyotheruser@contoso.onmicrosoft.com/messages
Headers: Authorization: Bearer &lt;auth token from step #4&gt;
</code></pre>

<p>I get a 403 Forbidden response with:</p>

<pre><code>{
    "error": {
        "code": "ErrorAccessDenied",
        "innerError": {
            "date": "2016-06-07T08:47:27",
            "request-id": "5b629e30-e6bd-474d-b3dd-8ce25c5ad1c4"
        },
        "message": "Access is denied. Check credentials and try again."
    }
}
</code></pre>