https://login.microsoftonline.com/mytenant.co.uk/oauth2/v2.0/authorize/?client_id=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaa&redirect_uri=https://mywebsite.com/login/authentication&response_type=code&scope=Contacts.Read&state=12345

$get_code = $_GET['code'];

$ch = curl_init();
curl_setopt_array($ch, array(
    CURLOPT_URL => 'https://login.microsoftonline.com/common/oauth2/v2.0/token/',
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_POST => 1,
    CURLOPT_POSTFIELDS => array(
        "client_id" => "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaa",
        "client_secret" => "qwertyuiopasdfghjkl",
        "code" => $get_code,
        "redirect_uri" => "https://mywebsite.com/login/authentication",
        "grant_type" => "authorization_code",
        "scope" => "Contacts.Read"
    )
));
$result = curl_exec($ch);
curl_close($ch);

$result = json_decode($result);

$resultAccessToken = "Bearer ".$result->access_token;

$ch2 = curl_init();
curl_setopt_array($ch2, array(
    CURLOPT_URL => 'https://graph.microsoft.com/v1.0/me/contacts',
    CURLOPT_RETURNTRANSFER => 1,
    CURLOPT_HEADER => 1,
    CURLOPT_HTTPHEADER => array(
        "Authorization" => $resultAccessToken
    )
));
$result2 = curl_exec($ch2);
curl_close($ch2);

echo $result2;