# Bing Ads with SSO

## Connecting Bing Ads to HockeyStack (SSO / Microsoft Entra ID)

If your organization uses SSO through Microsoft Entra ID, connecting Bing Ads requires a few extra steps. The person completing the connection must have **all three** of the following:

* **HockeyStack admin** access
* **Microsoft Entra ID Global Admin** privileges (or have their Global Admin complete Step 1)
* **Microsoft Advertising** account access with permission to your org's ad accounts

***

### Step 1 — Attempt the Connection and Grant Admin Consent

HockeyStack won't appear in your Entra ID tenant until someone initiates the connection flow first. Expect the first attempt to be rejected — this is normal.

1. In HockeyStack, go to **Atlas → Ingest → Bing Ads** and start the connection flow.
2. You'll be redirected to a Microsoft sign-in page. After signing in, you'll see a **"Request pending"** screen. This means the app has been registered in your tenant but still needs admin consent.
3. Now have your **Entra Global Admin** sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
4. Go to **Enterprise Applications** → search for **HockeyStack** → open it.
5. Select **Permissions** in the sidebar.
6. Click **"Grant admin consent for \[Your Organization]"** and accept the permissions in the popup.

> **Important:** Approving a consent *request notification* (under Admin consent requests → My Pending) is **not** the same as granting admin consent. You must click the "Grant admin consent" button on the Permissions page.

***

### Step 2 — Verify Microsoft Advertising Access

The connecting user must have an active Microsoft Advertising account. If they don't, the OAuth flow will succeed but you'll get an error like `"An error occurred while fetching bingAds account"`.

* Go to [Microsoft Advertising](https://ads.microsoft.com/) and invite the connecting user as an Admin.
* They must sign in at least once to complete account setup.

> If the user's email is tied to both a personal Microsoft Account and a work Entra ID account, Microsoft may block the sign-in. Use a different user or resolve the identity conflict first.

***

### Step 3 — Retry the Connection in HockeyStack

1. Go back to **Atlas → Ingest → Bing Ads** and start the connection flow again.
2. Enter your **Entra Tenant ID**.
3. Sign in with the account that has both Entra consent and Microsoft Advertising access.
4. Select your organization's Bing Ads account when prompted.

You should see **"Bing Ads configured successfully."** Contact HockeyStack support if you need an immediate data sync.

***

### Troubleshooting

| Symptom                              | Cause                                                   | Fix                                                                   |
| ------------------------------------ | ------------------------------------------------------- | --------------------------------------------------------------------- |
| "Request pending" screen             | Admin consent not granted in Entra                      | Complete Step 1 — grant consent on the Permissions page               |
| "Error fetching bingAds account"     | Connecting user lacks Microsoft Advertising access      | Complete Step 2 — invite user and have them sign in once              |
| "Must use a different identity type" | Email tied to both personal and work Microsoft accounts | Connect with a user who doesn't have this conflict                    |
| Consent granted but still pending    | Approved the notification, not the actual consent       | Click "Grant admin consent" on the Permissions page (separate action) |
| Multiple accounts in picker          | Multiple Microsoft sessions in browser                  | Use incognito and sign in with your primary work email only           |

***

*Still stuck? Contact HockeyStack support with screenshots of the error and the email address used to connect.*