This guide is for the Microsoft Entra ID (Azure AD) administrator at your organisation. It explains why approval is needed and how to grant it once so your team can connect Microsoft Advertising accounts to Bright Analytics without each user hitting an approval wall.

To pull reporting data from Microsoft Advertising, Bright Analytics authenticates each user through Microsoft's standard OAuth sign-in. Microsoft Advertising publishes only one permission scope for its API - msads.manage - and there is no separate read-only or reporting-only scope available. Every application that touches the Microsoft Advertising API, including ones that only read reports, must request this single scope.

Microsoft classifies msads.manage as a permission that lets an app act on a user's advertising accounts, so by default many tenants require an administrator (rather than an individual user) to approve it. When your tenant's consent policy is set this way, a user signing in sees an "approval required" or "admin approval required" message and cannot proceed on their own.

Granting consent does not give Bright Analytics any access beyond what the signed-in user already has. Access is still scoped to the specific Microsoft Advertising accounts that user can see, and is further gated by Bright Analytics' own developer token and the user's account permissions. Approval simply removes the per-user prompt.

Approving the app once, tenant-wide, means your users can sign in and connect their Microsoft Advertising accounts without each being individually blocked. It does not automatically grant Bright Analytics access to any data on its own - a user still has to sign in and authorise their own accounts. It also does not expand the permission beyond msads.manage; you are consenting to exactly the scope the app requests, nothing more.

You will need to be a Global Administrator, Application Administrator, or Cloud Application Administrator in your Entra tenant.

The Bright Analytics application (client) ID is:

6ef39a49-3313-4fcd-81b3-a2206672fa8b

Open the following URL in a browser while signed in with your admin account. Replace YOUR_TENANT_ID with your tenant ID or your verified domain (for example contoso.com):

https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=6ef39a49-3313-4fcd-81b3-a2206672fa8b

You will see a consent screen describing the app and the Microsoft Advertising permission it requests. Review it and accept. Once you do, the Bright Analytics application appears under Enterprise applications in your tenant, and your users can sign in without being prompted for approval.

If a user has already attempted to sign in, their request may be waiting for you:

If your tenant has the admin consent workflow enabled, you may instead receive the user's access request by email and can approve it directly from there.

Your users can return to Bright Analytics, start the Microsoft Advertising connection again, sign in with their Microsoft Advertising credentials, and select the accounts they want to report on. They should no longer see the approval-required message.

If users still see "you do not have permission to access this app" after consent, check Enterprise applications > Bright Analytics > Properties for the setting Assignment required. If this is turned on, you will need to assign the relevant users or groups to the app, or turn it off so any signed-in user in your tenant can use it.

If you have questions or the consent screen does not appear as expected, contact your Bright Analytics representative.