add the last step - get an access token for the user's tenant