title: Office365 API - Accessing another users/room's calendars
body: <p>I'm attempting to build an application that will have access to all of an organization's calendars (users, rooms, etc).</p>
  <p>Currently my auth flow will sign in on behalf of a tenant user and make use of refresh tokens to access needed resources. As soon as I make a request to:</p>
  <pre><code>https://outlook.office365.com/api/v1.0/users/{room-resource@email}/events
  </code></pre>
  <p>My application is responded with a <code>401</code></p>
  <p>From my gathering, it seems that this flow is limited to a single user's scope. Although the tenant admin <em>should</em> have permission to see any of the room resources, the room is technically a user itself so the API will respond with a forbidden error. It now seems that the proper flow is a tenant admin must grant permission to my application using the new <a href="http://blogs.msdn.com/b/exchangedev/archive/2015/01/22/building-demon-or-service-apps-with-office-365-mail-calendar-and-contacts-apis-oauth2-client-credential-flow.aspx" rel="nofollow noreferrer">Service OAuth Flow</a>.</p>
  <p>Reading through this post it seems that the API is making use of OAuth <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.4" rel="nofollow noreferrer">client credentials grant type</a> (app only tokens). Instead of using the <code>/oauth/common</code> endpoint I now have to use <code>/oauth/tenant-id</code> which I can retrieve via the JWT token returned in the <code>code+id_token</code> response type. This leads to my first question:</p>
  <p><strong>Is using the OpenID flow the only way to initially retrieve the tenant ID?</strong></p>
  <p>Next is where things get a little fuzzy for me.</p>
  <p>We now have to generate an X.509 SSL certificate and upload the fingerprint/value to our Azure application manifest. Easy enough.</p>
  <p>Then according to the discussion in <a href="https://stackoverflow.com/questions/28351558/office-365-rest-api-daemon-week-authentication">Office 365 Rest API - Daemon week authentication</a> we build a specific JWT, base64 encode it, and sign it with our cert.</p>
  <p>I haven't actually gotten to the last few steps here but I will post my results when I can. I'm just making sure that I seem to be following the correct procedure for what resources I'm trying to access. I know the service tokens are a fairly new feature, it's just unfortunate that I had to find the flow of sending the signed JWT on Stackoverflow rather than official MSFT documentation...</p>
  <p>I also noticed that since we're using the client credentials flow we will not receive a <code>refresh_token</code> in the response. So for my final question:</p>
  <p><strong>When accessing different resources (ie Graph API/Office365 API) do I just get a different access token for each resource using my signed request instead of <a href="https://msdn.microsoft.com/en-us/library/azure/dn645538.aspx" rel="nofollow noreferrer">using refresh tokens for multiple resources</a>?</strong></p>
  <p>If the general direction I seem to be going is correct let me know! Any help is greatly appreciated.</p>