How do I exchange an authorization code for an access_token for Azure AD Multi-Tenant application?

Question

I am writing a web app that will access client data stored in Microsoft Dynamics CRM Online. I want to allow my users to grant access to their Dynamics account using OAuth.

1. I created a multi-tenant application in Azure AD, providing redirect_uris, generating a client id & secret. Multi-tennant is set to ON.
2. I created a demo Microsoft Dynamics CRM account . "examplecrmaccount.crm4.dynamics.com".
3. I have successfully generated an authorization url, sent users to the authorization screen, and received the "code" that should be exchanged for an "access token".

I am unable to exchange this "code" for an "access_token".

$data = array(
    "grant_type" => "authorization_code", 
    "client_id" => urlencode("my_app_azure_ad_client_id"),
    "redirect_uri" => urlencode("https://myapp.com/callback"),
    "client_secret" => urlencode("my_app_azure_ad_client_secret"), 
    "code" => urlencode("code_returned_from_previous_request"),
    "resource" => urlencode("https://examplecrmaccount4.crm4.dynamics.com")
);

$endpoint = "https://login.windows.net/common/oauth2/token?api-version=1.0";

$response = helpers\Curl::doPOST(
    $endpoint,
    null,    
    array("Content-type: application/x-www-form-urlencoded"),
    $data
);

The server response:

Status 404
StatusName Not Found
{"error":"invalid_request","error_description":"ACS90002: No service namespace named \u0027common\u0027 was found in the data store.\r\nTrace ID: b1025082-3e9b-49d8-bf91-7d998f694162\r\nCorrelation ID: 49d9d1e5-6958-4ffc-91ff-464f078a00f5\r\nTimestamp: 2014-09-12 08:35:59Z","error_codes":[90002],"timestamp":"2014-09-12 08:35:59Z","trace_id":"b1025082-3e9b-49d8-bf91-7d998f694162","correlation_id":"49d9d1e5-6958-4ffc-91ff-464f078a00f5"}

Answer 1

Remove the "api-version=1.0" query param and it should work. It's a bug in our docs and the Azure portal to tell you to add that when you are using the authorization code flow.