# Microsoft Ads setup for PopMCP You register an app in the Microsoft Entra admin center, request a developer token in Microsoft Advertising, copy the app's Application (client) ID, a client secret Value and the developer token into PopMCP, then sign in with Microsoft and pick your ad account. - Auth: OAuth authorization - Setup time: 8 min - API base URL: https://campaign.api.bingads.microsoft.com/CampaignManagement/v13 - Credentials screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade - Provider docs: https://learn.microsoft.com/en-us/advertising/guides/get-started ## Approval required before this works Microsoft Advertising requires a developer token on every API call, on top of your Microsoft sign-in. A Super Admin of a Microsoft Advertising account requests it in the web app; the universal token it issues works with any user's sign-in and grants no extra access. - Typical wait: Usually issued as soon as you request it. Microsoft publishes no timeframe, and some requests are held for review before the token shows as active. - Cost: Free. A developer token and API access cost nothing; you need a Microsoft Advertising account (also free to open) and ad spend is separate. - Blocked until approved: Every call. Without a developer token Microsoft Advertising answers error 105 (InvalidCredentials) to all of Campaign Management, Reporting, Ad Insight, Bulk, Customer Management and Billing, so the connection cannot even list your ad accounts. - Works meanwhile: Register the app in the Microsoft Entra admin center, add PopMCP's Redirect URI and create the client secret. Once the token shows under Developer token, fill in the connect form and sign in. ## Before you begin - A Microsoft Advertising account and the Microsoft account you sign in to it with (work, school or personal). Agency users: your login must reach the client accounts through your manager account. - The Super Admin role on that Microsoft Advertising account, or a Super Admin who will request the developer token for you. - A Microsoft Entra tenant you can register apps in: your organization's (members can register apps unless an admin turned that off), or, with only a personal account, a tenant of your own such as the Default Directory of an Azure account. - PopMCP's Redirect URI from the connect form: https://app.popmcp.com/api/providers/microsoft/callback ## Get your credentials ### 1. Open App registrations Go to entra.microsoft.com and sign in. If you belong to several tenants, use the Settings icon in the top bar to switch to the one that should own the app. Open Entra ID > App registrations and select New registration. Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade ### 2. Register the app Enter a Name people will recognize, such as `PopMCP`: Microsoft shows it when asking for access. Under Supported account types pick Any Entra ID Tenant + Personal Microsoft accounts, so whichever Microsoft account you use at ui.ads.microsoft.com can sign in, then select Register. Single tenant only works too for your organization's accounts, but then the app's Directory (tenant) ID goes into PopMCP as well. No API permissions need adding: Microsoft Advertising's permission is asked for when you sign in. Screen: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade ### 3. Add PopMCP's Redirect URI On the new app, open Authentication under Manage. On the Redirect URI configuration tab select Add Redirect URI, choose the Web tile, enter `https://app.popmcp.com/api/providers/microsoft/callback` exactly as PopMCP shows it, and select Configure. ### 4. Create a client secret Open Certificates & secrets, stay on Client secrets and select New client secret. Enter a description such as `PopMCP`, choose when it expires (24 months at most; Microsoft recommends less than 12) and select Add. Copy the Value column straight away: Microsoft never shows it again. The Secret ID beside it is not the secret. ### 5. Copy the Application (client) ID Open Overview and copy the Application (client) ID. You only need the Directory (tenant) ID if you chose Single tenant only. ### 6. Request a developer token in Microsoft Advertising Microsoft Advertising wants a developer token on every call as well as your sign-in. Sign in at ui.ads.microsoft.com as a Super Admin, open Settings in the left rail, then Developer settings. Choose yourself under Select user, read the Microsoft Developer Services Agreement and select Request Developer Token. It is usually issued at once; copy the value shown under Developer token. Not a Super Admin? Ask one on your account to request it for you. Screen: https://ads.microsoft.com/cc/Settings/DevSettings ### 7. Fill in PopMCP and sign in In PopMCP put the ID in Application (client) ID, the secret's Value in Client secret Value and the token in Developer token (the Directory (tenant) ID under More options only for a Single tenant only app). Select Sign in with Microsoft, pick the account you use for Microsoft Advertising and select Accept. PopMCP then lists every ad account that login reaches, including client accounts linked to your manager account: tick the ones to connect and the workspace each goes in. ## Fields PopMCP asks for - Application (client) ID (clientId) [required]: Only for your own app. In the Microsoft Entra admin center (entra.microsoft.com) open Entra ID, App registrations, New registration, pick Any Entra ID Tenant + Personal Microsoft accounts under Supported account types and select Register, then copy the Application (client) ID from Overview. No API permissions need adding. - Client secret Value (clientSecret) [required]: In the app registration open Certificates & secrets, Client secrets, New client secret, then Add, and copy the Value column right away (it is shown once). Stored encrypted and used only on our server. - Developer token (developerToken) [required]: In Microsoft Advertising (ui.ads.microsoft.com) open Settings, then Developer settings, choose the user under Select user, accept the agreement and select Request Developer Token. You need the Super Admin role. Copy the token shown under Developer token. - Directory (tenant) ID (tenant): Only for an app registered as Single tenant only. Copy it from the app's Overview page. ## Callback URL to register https://app.popmcp.com/api/providers/microsoft/callback ## Scopes requested - https://ads.microsoft.com/msads.manage - offline_access - openid - profile - email ## Verify PopMCP shows Microsoft Ads as Connected under the ad account's name and number, and microsoft_ads_account_overview returns the account's currency, time zone and campaigns. ## Troubleshooting ### "Microsoft Advertising did not accept the sign-in or the developer token" Cause: Error 105 (InvalidCredentials): the developer token is the sandbox one (BBD37VB98) or not active yet, or you signed in with a Microsoft account that has no Microsoft Advertising access. Fix: Copy the production token from **Settings** > **Developer settings** at ui.ads.microsoft.com, check it shows as active, and sign in with the account you use there. ### "The app needs access to a service that your organization has not subscribed to or enabled" Cause: Microsoft answered AADSTS650052: the Microsoft Advertising app is not set up in your organization's Entra tenant. Fix: An Entra admin adds it once with Microsoft Graph: `POST https://graph.microsoft.com/v1.0/servicePrincipals` with body `{"appId": "d42ffc93-c136-491d-b4fd-6f18168c68fd"}`, as Microsoft's Advertising docs describe. Then connect again. ### "The app's redirect URI does not match" Cause: Microsoft answered AADSTS50011: PopMCP's callback is not registered as a Web redirect URI on the app, or differs by a character. Fix: Open **Authentication**, select **Add Redirect URI**, choose **Web**, enter `https://app.popmcp.com/api/providers/microsoft/callback` and select **Configure**, then connect again. ### "Microsoft did not accept the app's client secret" Cause: The **Secret ID** went in instead of the secret's **Value** (AADSTS7000215), or the secret expired (AADSTS7000222). Fix: Under **Certificates & secrets** create a new client secret, copy its **Value** right away and connect again with it. ### No ad accounts in the list Cause: The Microsoft account you signed in with is not a user on any Microsoft Advertising account, or every account it reaches is closed. Fix: Sign in at ui.ads.microsoft.com with the same account to check what it can open, then connect again with the right one. ### "Microsoft Advertising would not reach this ad account through the manager account it was listed under" Cause: Error 1029 or 1490: the account link to your manager account changed after you connected. Fix: Reconnect Microsoft Ads and pick the account again, so PopMCP records the manager account you reach it through. ### "Microsoft Advertising is limiting calls for this user" Cause: Error 117 (CallRateExceeded): too many calls in a minute. Fix: Wait a minute and try again. Ask for many ids in one call, and use reports instead of one call per item. --- Source: https://www.docs.popmcp.com/docs/integrations/microsoft-ads/