Bing Ads - Troubleshooting

Updated on

Jun 8, 2026

While configuring your Bing Ads connection, you may encounter several issues. Understanding these common errors can help streamline the setup process and facilitate quick resolutions.

Authorization issues

Authorization error: Need admin approval / Approval required

Error message:

{%docs-informer error%}


Need admin approval. Improvado needs permission to access resources in your organization that only an admin can grant.

{%docs-informer-end%}

What this means

Microsoft tags the msads.manage scope (Microsoft Advertising API) as admin-consent-required at the API level. In any Microsoft Entra ID (Azure AD) tenant that uses the default consent policy, which is the default for most enterprise tenants, a regular user cannot grant consent on their own, regardless of their Microsoft Advertising role. Even a user with the Super Admin role in Microsoft Advertising will see this prompt.

This is by Microsoft's design for the Advertising API. It is not an Improvado configuration issue.

App details to share with your Microsoft / Entra admin

App name in Entra: Improvado
App ID / Client ID: fa54b799-584e-4181-94c2-6bb53879ede5
Redirect URI: https://connections.improvado.io/stat_provider_client/oauth_redirect/bing/
Delegated permissions: https://ads.microsoft.com/msads.manage (Microsoft Advertising API), offline_access, openid (Microsoft Graph)

After admin consent is granted

The user who creates the Bing Ads connection in Improvado needs the Data Manager role (or higher) in their Improvado workspace. The Data Load Manager role alone is not enough to finalize the connection. See Available user roles. Once admin consent is in place and the user has the Data Manager role, retry the Bing Ads connection. It will complete without the approval prompt, and extraction resumes on the next scheduled run.

Authorization error: AADSTS650052 / AADSTS650057

Error message:

{%docs-informer error%}


cannot get code for Bing. Error description=AADSTS650052

{%docs-informer-end%}

What this means

The AADSTS650052 error indicates that Microsoft's Advertising API Service lacked a required Service Principal during consent attempts. Despite "Allow user consent for apps" settings, certain Microsoft applications still demand admin-level authorization for proper tenant initialization.

Starting April 2025, Microsoft began enforcing mandatory service principal registration for all multi-tenant applications. Previously, Microsoft silently issued tokens even when the tenant lacked a service principal. Now, this is blocked. Learn more about this change.

Recommended Solution

Option 1: Sign in to Microsoft Advertising with a Tenant Admin (simplest)

Contact your Azure AD Global Administrator to establish access. Have the Azure AD Global Administrator log in directly to ads.microsoft.com and connect the Bing Ads account. This action grants necessary admin consent and automatically provisions the required service principal. After that, go back to Improvado and retry the connection.

Option 2: Create the Service Principal via Microsoft Graph API

If Option 1 doesn't work, the administrator can provision the service principal manually.

Using Microsoft Graph Explorer:

Sign in as an admin.
Run the following request:


  POST https://graph.microsoft.com/v1.0/servicePrincipals
Content-Type: application/json

{
  "appId": "d42ffc93-c136-491d-b4fd-6f18168c68fd"
}

Alternatively, using Azure CLI:


az ad sp create --id d42ffc93-c136-491d-b4fd-6f18168c68fd

Wait a few minutes for propagation, then retry the Improvado connection.

Option 3: Grant Admin Consent via URL

The administrator can visit this URL in a browser (replace {your-tenant-id} with your Microsoft Entra ID tenant ID):


https://login.microsoftonline.com/{your-tenant-id}/adminconsent?client_id=d42ffc93-c136-491d-b4fd-6f18168c68fd

To find your tenant ID: go to Azure Portal → Microsoft Entra ID → Overview → Tenant ID.

Authorization error: IdentityTypeMismatch (Code 126)

Error message:

{%docs-informer error%}


"You must use a different identity type to sign in to Bing Ads with the same email."

{%docs-informer-end%}

What this means

Your Microsoft Advertising account is linked to a specific identity provider (Microsoft or Google). You are trying to authorize through a different identity provider than the one your account was created with.