Creating credentials and connecting Microsoft Advertising sources requires logging into a Microsoft Advertising user account and granting consent for it to be managed by Funnel.
The ability of a user to grant consent to Funnel depends on the type of Identity service account used to log in to Microsoft Advertising, either:
a Microsoft account (also called a personal account) created by an individual, or
a work account issued by an organisation using Azure AD.
All accounts must fulfil the following conditions in order to grant consent to Funnel:
two-step authentication enabled
added as a user to either:
the Microsoft Advertising account intended as a data source
a Microsoft Advertising account with an account link to the one intended as a data source
Microsoft accounts (personal accounts) should able to grant consent to Funnel if the above conditions are met. Work accounts require an additional condition be met in order to grant consent to Funnel:
The Require sign-in with a work account setting must be enabled on the Microsoft Advertising account intended as a data source.
Work accounts fulfilling all the above conditions still may not be able to grant consent to Funnel due to restrictions imposed by the organisation that issued them. If the ability for a work account to grant consent is restricted, one of the two following scenarios will occur after logging in to the work account during the data source connect process in Funnel:
a form for requesting consent from organisation admins is displayed
Submit the consent request and contact the relevant individual or department in your organisation that manages work accounts asking them to consent to the request. After consent is granted, attempt the data source connect process again.a connect error is displayed stating your work account is restricted
Contact the relevant individual or department in your organisation that manages work accounts and request that an admin with sufficient privileges complete step 1 of the data source connect process in Funnel. Afterwards, attempt the data source connect process again.
Information for Azure AD administrators
Funnel has an Azure AD application for accessing the Microsoft Advertising API. Organisations using Azure AD need to create a service principal for Funnel's Azure AD application in order to allow work accounts to connect to Microsoft Advertising in Funnel. A service principal is not an Azure AD application and there is no requirement for organisations to register new Azure AD applications. See Microsoft's documentation on service principals and applications and on how service principals are created.
A service principal is created when a work account belonging to an organisation consents to the Microsoft Advertising permissions requested by Funnel's Azure AD application during step 1 of the data source connect process in Funnel. In order to consent, the work account needs sufficient Azure AD privileges.
The way that the data source connect process in Funnel handles work accounts without sufficient Azure AD privileges depends on the organisations Azure AD consent workflow setup:
If an admin consent workflow is enabled, a dialogue will be displayed where the work account can request consent from an Azure AD administrator. An administrator will receive a notification in Azure AD which will advise on how consent may be granted to Funnel's application.
If no admin consent workflow is enabled, an error will be displayed directing users to this help article. In this case, the only way to grant consent is via an Azure AD administrator with sufficient privileges to consent to applications performing step 1 of the data source connect process in Funnel. This requires the conditions at the top of this help article also be fulfilled, i.e. the admin may need to sign up to Microsoft Advertising and be added to the advertising account intended as a data source in Funnel. Once step 1 of the data source connect process has been completed, a service principal has been created and there is no need to continue the process. The admin's Microsoft Advertising user account does not need to persist and may be deleted after the service principal is created.
Once consent has been granted and a service principal created, Funnel's Azure AD application should be listed on an organisation's Enterprise Applications page.