When you connect Microsoft Ads to Tracify, Microsoft first signs you in through Microsoft Entra ID (formerly Azure AD). The IT policies of your organization decide whether this sign-in goes through. If it fails, you see an error page from Microsoft with an error code. This article explains what the codes mean and how your IT fixes them.
In this article
Why the connection can fail
Even if you are an admin in Microsoft Ads, your Entra tenant may restrict:
whether users can approve ("consent to") third-party apps such as Tracify,
which Microsoft services and APIs are enabled for the tenant,
conditional access rules, for example compliant devices, locations or MFA.
In these cases an Entra ID admin of your organization has to approve Tracify or adjust the policy. A Global Administrator, Cloud Application Administrator or Application Administrator can do this, a regular user cannot.
What to send to your IT
Copy the full error page and send it to your IT department. They need:
the error code, for example AADSTS650052,
the correlation ID,
the timestamp.
With these three values your IT finds the exact failure in the Entra sign-in logs.
Common causes
Cause | What it means | Who fixes it |
Admin approval required | Your organization does not allow users to approve third-party apps. IT has to approve Tracify. | Entra ID admin |
A required Microsoft service is not registered in the tenant | Microsoft Ads needs the Microsoft Advertising API service. If the tenant does not know it, Microsoft blocks the sign-in with AADSTS650052. | Entra ID admin, see below |
Conditional access blocks the sign-in | Your organization requires compliant devices, specific locations or approved apps. IT has to exempt Tracify or you have to meet the requirement. | Entra ID admin |
Fix for AADSTS650052
The error says that your organization lacks a service principal for the Microsoft Advertising API. In simple terms: the Microsoft account of your organization does not yet know the Microsoft Advertising API as an approved service, so Tracify cannot request advertising permissions. An Entra ID admin registers it once with one of the two options below, after that the error does not come back.
The admin needs the tenant ID: a GUID in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. You find it in the Microsoft Entra admin center under Overview, or in the Azure Portal under Azure Active Directory › Overview.
Option 1: Azure CLI
Install the Azure CLI if you do not have it: macOS brew install azure-cli, Windows winget install Microsoft.AzureCLI or the installer from Microsoft, Linux: see Microsoft's Linux guide. On Debian or Ubuntu: curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash. Then sign in to the tenant as admin:
az login --tenant {your-tenant-id} --allow-no-subscriptionsCreate the service principal of the Microsoft Advertising API:
az ad sp create --id d42ffc93-c136-491d-b4fd-6f18168c68fd
The response is a JSON with "appDisplayName": "Microsoft Advertising API Service" and "accountEnabled": true. That confirms the registration.
Option 2: PowerShell
If the Azure PowerShell module is installed, sign in:
Connect-AzAccount -TenantId {your-tenant-id}Create the service principal:
New-AzADServicePrincipal -ApplicationId d42ffc93-c136-491d-b4fd-6f18168c68fd
After the fix
Go back to Settings › Integrations › Microsoft Ads in Tracify and connect your ad account again: How do I set up Microsoft Ads?
If you still see an error, take a screenshot of the error page, copy the full URL from the address bar and send both to us via the chat.