In order to create a Microsoft Advertising credential in Funnel, Microsoft work accounts provisioned via Azure Active Directory (AAD) must have appropriate AAD permissions to be able to consent to delegated access via Funnel's AAD application Funnel-Microsoft-Ads-Connector.
Service Principals
When a work account with appropriate AAD permissions successfully consents to Funnel-Microsoft-Ads-Connector, a service principal is created on the AAD tenant that the consenting work account is associated with. A service principal is not an AAD application, instead is an object that authorises the Funnel-Microsoft-Ads-Connector AAD application to access resources on a third-party tenant. See Microsoft's documentation on service principals and applications and on how service principals are created.
As long as a service principal for Funnel-Microsoft-Ads-Connector exists on a tenant, all work accounts associated with the tenant will be able to consent to delegated access via the Microsoft sign-in dialogue displayed when creating credentials in Funnel.
Permissions for creating service principals
The appropriate AAD permissions required for granting consent to Funnel-Microsoft-Ads-Connector depend on each organisation's AAD configuration. For reference, the following Microsoft Entra build-in roles have appropriate permissions to create service principals:
Application Administrator
Cloud Application Administrator
Hybrid Identity Administrator
Creating a service principal for Funnel-Microsoft-Ads-Connector
If an admin consent workflow is enabled in AAD, work accounts attempting to create Microsoft Advertising credentials in Funnel will be able to submit admin consent requests directly from the Microsoft dialogue shown after singing in via Funnel. These can then be approved via the Admin consent requests dashboard in the Microsoft Entra admin center.
If no admin consent workflow is enabled, a work account with sufficient permissions for creating service principals and fulfilling the conditions for connecting to Microsoft Advertising must successfully create a Microsoft Advertising credential in Funnel by consenting to the delegated access dialogue displayed after signing in via Funnel.
Once consent has been granted and a service principal created, Funnel-Microsoft-Ads-Connector should be listed on an organisation's Enterprise Applications page.