我想我已经弄明白了，但我不知道为什么它不工作，如果我这样做在同一流程，所以我必须做的是调用微软图形API（我这样做是通过联盟。

$oauthClient = new \League\OAuth2\Client\Provider\GenericProvider([
            'clientId'                => $this->clientId,
            'clientSecret'            => $this->clientSecret,
            'redirectUri'             => "<redirect url>",
            'urlAuthorize'            => "https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/authorize",
            'urlAccessToken'          => "https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/token",
            'urlResourceOwnerDetails' => '',
            'scopes'                  => "openid profile User.Read offline_access Sites.Read.All",
        ]);
        $accessToken        = $oauthClient->getAccessToken("authorization_code", ['code' => $authorization_code]);

在我获得access_token和refresh_token之后，我使用curl通过使用上一步中的frefresh_token来获得sharepoint online的access_token和refresh_token：

$curl = curl_init();
        curl_setopt_array($curl, array(
          CURLOPT_URL => "https://login.microsoftonline.com/<tenant id>/oauth2/v2.0/token",
          CURLOPT_RETURNTRANSFER => true,
          CURLOPT_MAXREDIRS => 10,
          CURLOPT_TIMEOUT => 0,
          CURLOPT_CUSTOMREQUEST => "GET",
          CURLOPT_POSTFIELDS => "client_id=<client id>&client_secret=<client secret>&refresh_token=<refresh token from the previous step>&grant_type=refresh_token&scope=https%3A%2F%<tenant name>.sharepoint.com%2FSites.Read.All",
          CURLOPT_HTTPHEADER => array(
            "Content-Type: application/x-www-form-urlencoded"
          ),
        ));
        $SPOResponse = curl_exec($curl);
        $SPOResponse = json_decode($SPOResponse);
        $SPOHttpcode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
        curl_close($curl);

我试图使这一切工作在1个步骤，但我不能使它发生的一些原因，如果我找到一种方法，我会更新这个职位。