Microsoft Advertising Account (Bing)

In order to provide Bing spend reporting access to Rockerbox, the person completing the authentication in the Rockerbox platform must 1.) log in via their Microsoft work account and 2.) have permission to consent any app to access their organization’s data.

Troubleshooting Guide

Microsoft Azure Permissioning Issue

Microsoft Azure Permissioning Issue
If you receive an error message during the authentication flow that says AADSTS650052: The app needs access to a service (ads.microsoft.com) that your organization has not subscribed to or enabled, then this indicates an Azure tenant provisioning issue, meaning that the user attempting to authenticate Bing does not have the necessary level of permissions required to allow third-party-apps to make changes on their behalf.

Steps to resolve:

  1. First, ensure that log-in attempts are occurring from a work account, and not a personal account.
  2. If a log-in attempt from a work account fails, an Azure tenant admin at your organization will need to login to the Azure portal with a work account in order to unblock provisioning.
  3. Under the section titled User consent for applications, your admin will need to select Allow user consent for apps(otherwise, the user trying to grant Rockerbox access to Bing won’t have the permission of Microsoft’s ads service until this setting is provisioned)
  1. Once the policy has been updated, a simple log-in to the Bing Ads site from a user from that tenant should unblock the provisioning. To check that that’s the case, in the “API permissions” tab of an (owned) app registered in that tenant, you should be able to see and select “Microsoft Advertising API Service” as a dependency, like this:
More Information on Azure Settings
Additional information from Microsoft can be found here: Configure how users consent to applications - Azure AD | Microsoft Docs

Admin Approval Required

Rockerbox requires permissions to the `msads.manage` scope from Bing to pull daily spend reporting. Additionally, on-going access to the data is required in order to continue pulling data from the Bing Ads API on a daily basis.

You may see screen saying your authentication request needs Admin approval, depending on your IT team's security policies.

Admin Approval Required
If you are shown a message that Admin Approval is required to authenticate Rockerbox, you can request approval. Your IT admin will need to approve the request in the Microsoft Entra admin center.

Steps to resolve:

  1. To review the admin consent requests and take action:
  2. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator who is a designated reviewer.
  3. Browse to Entra ID > Enterprise apps.
  4. Under Activity, select Admin consent requests.
  5. Select My Pending tab to view and act on the pending requests.
  6. Select the application that is being requested from the list.
  7. Evaluate the request and take the appropriate action:
    1. Approve the request. To approve a request, grant admin consent to the application. Once a request is approved, all requestors are notified that their request for access is granted. Approving a request allows all users in your tenant to access the application unless otherwise restricted with user assignment.
More Information on Admin Consent Requests
Additional information from Microsoft can be found here: Review and take action on admin consent requests

How did we do?