Microsoft Ads
Connect Microsoft Ads to manage Bing search, shopping and Performance Max campaigns, keywords and budgets, research keywords, and pull reports.
You register an app in the Microsoft Entra admin center, request a developer token in Microsoft Advertising, copy the app's Application (client) ID, a client secret Value and the developer token into PopMCP, then sign in with Microsoft and pick your ad account.
Developer token approval before this connector works
Microsoft Advertising requires a developer token on every API call, on top of your Microsoft sign-in. A Super Admin of a Microsoft Advertising account requests it in the web app; the universal token it issues works with any user's sign-in and grants no extra access.
- Typical wait
- Usually issued as soon as you request it. Microsoft publishes no timeframe, and some requests are held for review before the token shows as active.
- Cost
- Free. A developer token and API access cost nothing; you need a Microsoft Advertising account (also free to open) and ad spend is separate.
- Blocked until approved
- Every call. Without a developer token Microsoft Advertising answers error 105 (InvalidCredentials) to all of Campaign Management, Reporting, Ad Insight, Bulk, Customer Management and Billing, so the connection cannot even list your ad accounts.
- Works meanwhile
- Register the app in the Microsoft Entra admin center, add PopMCP's Redirect URI and create the client secret. Once the token shows under Developer token, fill in the connect form and sign in.
Where to apply: Sign in at ui.ads.microsoft.com as a Super Admin, open Settings in the left rail, then Developer settings. Choose the user under Select user, read the Microsoft Developer Services Agreement and select Request Developer Token. Copy the value shown under Developer token.
- Only a Super Admin can request a developer token. A Standard user or Campaign Manager asks a Super Admin of the account to request it for them.
- Use the production token. The universal sandbox token BBD37VB98 only works against Microsoft's sandbox, and production answers it with error 105.
- Copy the client secret's Value, not its Secret ID, and register the Redirect URI as a Web platform. Client secrets expire (24 months at most): create a new one and reconnect when yours does.
- If Microsoft answers that your organization has not enabled the service (AADSTS650052), an Entra admin adds the Microsoft Advertising app (d42ffc93-c136-491d-b4fd-6f18168c68fd) to the tenant once, as Microsoft's own docs describe.
- Microsoft throttles calls per user per minute (error 117, wait 60 seconds), limits reports in flight (error 207) and bulk downloads and uploads per account per period (error 4204, wait up to 15 minutes).
- Setup time
- 8 min
- Auth
- OAuth authorization
- API base URL
- https://campaign.api.bingads.microsoft.com/CampaignManagement/v13
- Rate limits
- Microsoft throttles per user and per customer in a sliding 60-second window (error 117: wait 60 seconds), limits reports in flight per account (error 207) and bulk downloads and uploads per account per period (error 4204: wait up to 15 minutes). The exact numbers are not published.
Before you begin
- A Microsoft Advertising account and the Microsoft account you sign in to it with (work, school or personal). Agency users: your login must reach the client accounts through your manager account.
- The Super Admin role on that Microsoft Advertising account, or a Super Admin who will request the developer token for you.
- A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off), or, with only a personal account, a tenant of your own such as the Default Directory of an Azure account.
- PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback
Get your credentials
Open App registrations
Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration.
App registrations
| Display name | Application (client) ID | Created on | Certificates & secrets |
|---|---|---|---|
| Marketing siteSingle tenant only | 4c5d****-****-****-****-****8e21 | 3/14/2026 | Current |
Owned applications lists the apps you registered yourself.
Register the app
Enter a Name people will recognize, such as PopMCP: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant + Personal Microsoft accounts, so whichever Microsoft account you use at ui.ads.microsoft.com can sign in, then select Register. Single tenant only works too for your organization's accounts, but then the app's Directory (tenant) ID goes into PopMCP as well. No API permissions need adding: Microsoft Advertising's permission is asked for when you sign in.
Register an application
The user-facing display name for this application.
Add PopMCP's Redirect URI
On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter https://app.popmcp.com/api/providers/microsoft/callback exactly as PopMCP shows it, and select Configure.
PopMCP | Authentication
Choose Web, not Single-page application or Mobile and desktop: the address must match character for character.
Create a client secret
Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as PopMCP, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret.
PopMCP | Certificates & secrets
| Description | Expires | Value | Secret ID |
|---|---|---|---|
| PopMCP | 4/24/2027 | Kq8~****************************3fZaCopy this one | 7d1e****-****-****-****-****0b9c |
Copy the Application (client) ID
Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only.
PopMCP
Overview
- Display name
- PopMCP
- Application (client) ID
- 2f6c****-****-****-****-****a91d
- Directory (tenant) ID
- 72f9****-****-****-****-****1db4
- Client credentials
- 0 certificate, 1 secret
- Redirect URIs
- 1 web, 0 spa, 0 public client
The Application (client) ID is a GUID. A value with a tilde in it is a client secret.
Request a developer token in Microsoft Advertising
Microsoft Advertising wants a developer token on every call as well as your sign-in. Sign in at ui.ads.microsoft.com as a Super Admin, open Settings in the left rail, then Developer settings. Choose yourself under Select user, read the Microsoft Developer Services Agreement and select Request Developer Token. It is usually issued at once; copy the value shown under Developer token. Not a Super Admin? Ask one on your account to request it for you.
Fill in PopMCP and sign in
In PopMCP put the ID in Application (client) ID, the secret's Value in Client secret Value and the token in Developer token (the Directory (tenant) ID under More options only for a Single tenant only app). Select Sign in with Microsoft, pick the account you use for Microsoft Advertising and select Accept. PopMCP then lists every ad account that login reaches, including client accounts linked to your manager account: tick the ones to connect and the workspace each goes in.
Connect in PopMCP
Open your workspace, choose Microsoft Ads in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Application (client) IDtext | Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant + Personal Microsoft accounts under Supported account types and select Register, then copy the Application (client) ID from Overview. No API permissions need adding. |
| Client secret Valuesecret | In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server.Encrypted with AES-256-GCM on save and never shown again. |
| Developer tokensecret | In Microsoft Advertising (ui.ads.microsoft.com) open Settings, then Developer settings, choose the user under Select user, accept the agreement and select Request Developer Token. You need the Super Admin role. Copy the token shown under Developer token.Encrypted with AES-256-GCM on save and never shown again. |
| Directory (tenant) IDtext | Only for an app registered as Single tenant only. Copy it from the app's Overview page. |
https://app.popmcp.com/api/providers/microsoft/callbackIn your app registration open Authentication, select Add Redirect URI, choose Web, enter this exact URL and select Configure. It must match exactly, or Microsoft refuses the sign-in. Every Microsoft connector uses this same URL.
PopMCP verifies the credential against Microsoft Ads immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Permissions PopMCP requests
These are the scopes sent to Microsoft Ads at authorization time.
| Scope | Why PopMCP asks for it |
|---|---|
| https://ads.microsoft.com/msads.manage | Microsoft Advertising's one permission: read and manage the ad accounts your login can open (campaigns, reports, keyword research, billing). It grants nothing your login cannot already do at ui.ads.microsoft.com. |
| offline_access | Makes Microsoft issue a refresh token, so the connection keeps working after the access token expires within about an hour. |
| openid | Sign-in: tells PopMCP which Microsoft account approved access. |
| profile | Sign-in: the account's name and tenant, used to label the connection and to send renewals to the right organization. |
| Sign-in: the account's address, shown on the connection. |
Verify it worked
PopMCP shows Microsoft Ads as Connected under the ad account's name and number, and microsoft_ads_account_overview returns the account's currency, time zone and campaigns.
Troubleshooting
"Microsoft Advertising did not accept the sign-in or the developer token"
Why: Error 105 (InvalidCredentials): the developer token is the sandbox one (BBD37VB98) or not active yet, or you signed in with a Microsoft account that has no Microsoft Advertising access.
Fix: Copy the production token from **Settings** > **Developer settings** at ui.ads.microsoft.com, check it shows as active, and sign in with the account you use there.
"The app needs access to a service that your organization has not subscribed to or enabled"
Why: Microsoft answered AADSTS650052: the Microsoft Advertising app is not set up in your organization's Entra tenant.
Fix: An Entra admin adds it once with Microsoft Graph: `POST https://graph.microsoft.com/v1.0/servicePrincipals` with body `{"appId": "d42ffc93-c136-491d-b4fd-6f18168c68fd"}`, as Microsoft's Advertising docs describe. Then connect again.
"The app's redirect URI does not match"
Why: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character.
Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again.
"Microsoft did not accept the app's client secret"
Why: The **Secret ID** went in instead of the secret's **Value** (AADSTS7000215), or the secret expired (AADSTS7000222).
Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and connect again with it.
No ad accounts in the list
Why: The Microsoft account you signed in with is not a user on any Microsoft Advertising account, or every account it reaches is closed.
Fix: Sign in at ui.ads.microsoft.com with the same account to check what it can open, then connect again with the right one.
"Microsoft Advertising would not reach this ad account through the manager account it was listed under"
Why: Error 1029 or 1490: the account link to your manager account changed after you connected.
Fix: Reconnect Microsoft Ads and pick the account again, so PopMCP records the manager account you reach it through.
"Microsoft Advertising is limiting calls for this user"
Why: Error 117 (CallRateExceeded): too many calls in a minute.
Fix: Wait a minute and try again. Ask for many ids in one call, and use reports instead of one call per item.
Reference
Meta Ads
Connect Meta Ads to manage campaigns, ad sets, ads, and creatives, and track insights, audiences, and lead ads. MCP setup guide for Claude and ChatGPT.
Connect Pinterest to create and schedule Pins, organise boards, track Pin and profile performance, research trends, and run your ad campaigns.