search

MicrosoftDocs / Advertising-docs

Creative Commons Attribution 4.0 International
15 stars 59 forks source link

Error on grant consent when following steps in document #851

Closed mikejhale closed 4 years ago

mikejhale commented 4 years ago

When going through the steps outlined on this page I get the following error when trying to grant consent:

The app needs access to a service ("https://ads.microsoft.com") that your organization "myorganization" has not subscribed to or enabled.

I have searched for a solution but there seems to be a configuration step missing in these docs. How can I grant access to Bing Ads API using an Azure App Registration?

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

eric-urban commented 4 years ago

@mikejhale please confirm whether your user credentials represent a personal or work account.

The identity endpoint supports both personal accounts and work accounts. A person whose credentials are valid in both the MSA and the Azure AD domains will encounter a disambiguation page that asks them to choose between their personal and their work or school identity. This disambiguation will always be present so long as this user has two identities tied to the same email address. The user can stop seeing this by changing the email address of their personal Microsoft account. For more information see https://cloudblogs.microsoft.com/enterprisemobility/2016/09/15/cleaning-up-the-azure-ad-and-microsoft-account-overlap/.

For more information about work accounts, please see the Microsoft Advertising help documentation.

Please also see the Microsoft Identity endpoint FAQ and let me know if you have any follow up questions or concerns.

mikejhale commented 4 years ago

@eric-urban It is using a Work Account, which is the same account that has a developer token on developers.ads.microsoft.com. I've also verified that the app registration in Azure is set to "Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)"

On Wed, Jul 15, 2020 at 10:13 AM Eric Urban notifications@github.com wrote:

@mikejhale https://github.com/mikejhale please confirm whether your user credentials represent a personal or work account.

The identity endpoint supports both personal accounts and work accounts. A person whose credentials are valid in both the MSA and the Azure AD domains will encounter a disambiguation page that asks them to choose between their personal and their work or school identity. This disambiguation will always be present so long as this user has two identities tied to the same email address. The user can stop seeing this by changing the email address of their personal Microsoft account https://support.microsoft.com/help/11545/microsoft-account-change-personal-email-address. For more information see https://cloudblogs.microsoft.com/enterprisemobility/2016/09/15/cleaning-up-the-azure-ad-and-microsoft-account-overlap/ .

For more information about work accounts, please see the Microsoft Advertising help documentation https://help.ads.microsoft.com/#apex/3/en/60043/-1.

Please also see the Microsoft Identity endpoint FAQ https://docs.microsoft.com/en-us/advertising/guides/authentication-oauth?view=bingads-13#q-what-is-the-user-experience-after-my-app-upgrades-to-the-microsoft-identity-platform-endpoint and let me know if you have any follow up questions or concerns.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/MicrosoftDocs/Advertising-docs/issues/851#issuecomment-658825627, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAIBL5BMSTXGYV56SL4MEJLR3XBQ5ANCNFSM4O2TRA4Q .

eric-urban commented 4 years ago

@mikejhale also just to confirm, are work accounts enabled in Microsoft Advertising? It might be most efficient to contact support to check specifics of your account setup.

mikejhale commented 4 years ago

@eric-urban I don't see a setting anywhere in M<icrosft Advertising to enable/disable work accounts, but the only login for the Ads account is a work account, so I'd assume they're enabled.

Also, I've tested this walkthrough with a completely separate Azure and Ads accounts, and run into the same issue. That is why I wondered if there was a configuration step missing either in Azure or in Ads.

eric-urban commented 4 years ago

@mikejhale sorry for the delay. If this is still a blocking issue I suggest please contact support or post in the new forum.