# Bing Ads with SSO

## Connecting Bing Ads to HockeyStack (SSO / Microsoft Entra ID)

If your organization uses SSO through Microsoft Entra ID, connecting Bing Ads requires a few extra steps. The person completing the connection must have **all three** of the following:

* **HockeyStack admin** access
* **Microsoft Entra ID Global Admin** privileges (or have their Global Admin complete Step 1)
* **Microsoft Advertising** account access with permission to your org's ad accounts

***

### Step 1 — Attempt the Connection and Grant Admin Consent

HockeyStack won't appear in your Entra ID tenant until someone initiates the connection flow first. Expect the first attempt to be rejected — this is normal.

1. In HockeyStack, go to **Atlas → Ingest → Bing Ads** and start the connection flow.
2. You'll be redirected to a Microsoft sign-in page. After signing in, you'll see a **"Request pending"** screen. This means the app has been registered in your tenant but still needs admin consent.
3. Now have your **Entra Global Admin** sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
4. Go to **Enterprise Applications** → search for **HockeyStack** → open it.
5. Select **Permissions** in the sidebar.
6. Click **"Grant admin consent for \[Your Organization]"** and accept the permissions in the popup.

> **Important:** Approving a consent *request notification* (under Admin consent requests → My Pending) is **not** the same as granting admin consent. You must click the "Grant admin consent" button on the Permissions page.

***

### Step 2 — Verify Microsoft Advertising Access

The connecting user must have an active Microsoft Advertising account. If they don't, the OAuth flow will succeed but you'll get an error like `"An error occurred while fetching bingAds account"`.

* Go to [Microsoft Advertising](https://ads.microsoft.com/) and invite the connecting user as an Admin.
* They must sign in at least once to complete account setup.

> If the user's email is tied to both a personal Microsoft Account and a work Entra ID account, Microsoft may block the sign-in. Use a different user or resolve the identity conflict first.

***

### Step 3 — Retry the Connection in HockeyStack

1. Go back to **Atlas → Ingest → Bing Ads** and start the connection flow again.
2. Enter your **Entra Tenant ID**.
3. Sign in with the account that has both Entra consent and Microsoft Advertising access.
4. Select your organization's Bing Ads account when prompted.

You should see **"Bing Ads configured successfully."** Contact HockeyStack support if you need an immediate data sync.

***

### Troubleshooting

| Symptom                              | Cause                                                   | Fix                                                                   |
| ------------------------------------ | ------------------------------------------------------- | --------------------------------------------------------------------- |
| "Request pending" screen             | Admin consent not granted in Entra                      | Complete Step 1 — grant consent on the Permissions page               |
| "Error fetching bingAds account"     | Connecting user lacks Microsoft Advertising access      | Complete Step 2 — invite user and have them sign in once              |
| "Must use a different identity type" | Email tied to both personal and work Microsoft accounts | Connect with a user who doesn't have this conflict                    |
| Consent granted but still pending    | Approved the notification, not the actual consent       | Click "Grant admin consent" on the Permissions page (separate action) |
| Multiple accounts in picker          | Multiple Microsoft sessions in browser                  | Use incognito and sign in with your primary work email only           |

***

*Still stuck? Contact HockeyStack support with screenshots of the error and the email address used to connect.*


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.hockeystack.com/integrations/ad-platforms/bing-ads/bing-ads-with-sso.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.