Azure AD multitenant Windows phone App authentication error

I am building a multi-tenant Windows Phone 8 app using multiple tenants in Windows Azure AD. The app basically authorizes the user and then accesses the graph API to read certain information in the AD for that particular user. 

As a beginning point I followed the guidance here: Using Windows Azure AD for native clients to use OAUTH 2.0 to authenticate and then get a token from the Windows Azure end points.

I use the following for the authorize endpoint:

https://login.windows.net/common/oauth2/authorize 

and this for the token endpoint:

https://login.windows.net/common/oauth2/token/  

For my testing I am using two different Azure AD tenants with two different domains tenant1.onmicrosoft.com and tenant2.onmicrosoft.com. Application is setup in tenant1's AD as a "native client application".

When I log in as a tenant1 admin user, I am able to get a token and access the Graph API information I need. I can also log in as a non-admin user from the tenant1 AD and get access to the Graph API.

Things are not working as expected for tenant2. When I log in as tenant2 admin, I get the expected consent page telling me that the app will access tenant2's AD (whatever permissions were set when the app was setup in tenant1's AD). When a user from the tenant2 tries to log in I get the following error, I believe it is coming from the token endpoint: 

"{\"error\":\"invalid_grant\",\"error_description\":\"AADSTS70000: Authentication failed. Authorization Code is malformed.\r\nTrace ID: 5cfa1c27-d95a-46b6-9e15-7b46d246f47b\r\nCorrelation ID: d86ff8ae-223a-4de0-ab27-5780a52fc581\r\nTimestamp: 2014-05-19 22:01:04Z\",\"error_codes\":[70000],\"timestamp\":\"2014-05-19 22:01:04Z\",\"trace_id\":\"5cfa1c27-d95a-46b6-9e15-7b46d246f47b\",\"correlation_id\":\"d86ff8ae-223a-4de0-ab27-5780a52fc581\"}" 

Why is this so? I would think that once tenant2 admin consented (assuming here the consent is on behalf of all the users in the AD) to access to it's AD, any user from this tenant is also allowed to authorize and have the app successfully access the Graph API?

Any help or guidance is really appreciated! 

Thanks,