How to resolve the authentication error (AADSTS650052) when connecting Microsoft Advertising

Symptom

When connecting Microsoft Advertising to Shirofune, the message "認証処理に失敗しました (Authentication failed)" may appear after signing in, and the connection cannot be completed.

In this case, the following error is occurring on the Microsoft side (the error text is not shown on the screen; it is recorded in the URL in your browser's address bar).

AADSTS650052: The app is trying to access a service 'Microsoft Advertising API Service'
that your organization lacks a service principal for.

Cause

The Microsoft Entra ID (formerly Azure AD) tenant that the signing-in account belongs to does not have a service principal for "Microsoft Advertising API Service".

• This only occurs when connecting with a work or school account. It does not occur with personal Microsoft accounts.
• In organizations where user consent for applications is restricted (a common setting in large enterprises), this service principal is not created automatically, so the error occurs the first time anyone in the organization attempts the connection.
• This cannot be resolved by any configuration change on the Shirofune side. Action by your organization's Microsoft Entra administrator is required.

Note: Microsoft's error message suggests that consenting to the application will create the required service principal. However, while the service principal is missing, the consent operation itself fails with the same error, so following that suggestion does not resolve the issue. Please start from Step 1 (creating the service principal) below.

Resolution steps

Steps 1 and 2 must be performed by your organization's Microsoft Entra administrator (Global Administrator, Application Administrator, or Cloud Application Administrator).

Step 1: Create the service principal

The administrator runs one of the following commands. This can also be done in Azure Cloud Shell, which you can launch from the >_ icon in the top bar of the Azure portal (no local installation required).

Using Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "Application.ReadWrite.All"
New-MgServicePrincipal -AppId "d42ffc93-c136-491d-b4fd-6f18168c68fd"

Using Azure CLI:

az ad sp create --id d42ffc93-c136-491d-b4fd-6f18168c68fd

Note: "Microsoft Advertising API Service" is a Microsoft first-party application, so it cannot be added manually via "+ New application" in the Microsoft Entra admin center. The commands above are the proper way to create it.

Step 2: Approve the Shirofune app (admin consent)

After completing Step 1, the same administrator opens the following URL in a browser. Replace {TENANT_ID} with your organization's tenant ID (you can find it in Microsoft Entra ID → Overview → Basic information → Tenant ID).

https://login.microsoftonline.com/{TENANT_ID}/adminconsent?client_id=9f44340e-8212-43b5-b53b-9528cd99853d

When the "Permissions requested" dialog appears, click Accept.

The only permissions Shirofune requests are Microsoft Advertising management (msads.manage / ads.manage) and offline access. It does not request access to email, files, or your directory. This is a one-time setup per organization.

About the screen after approval: After clicking Accept, you will land on a page that fails to load (such as "This site can't be reached"). This is expected and does not mean the approval failed. If the URL in your browser's address bar contains admin_consent=True and there is no "error" parameter, the approval was successful.

Step 3: Confirm the service principal was created (optional)

In the Microsoft Entra admin center → Enterprise applications:

1. Change the "Application type" filter to "All applications" (Microsoft applications are hidden by default).
2. Search by name for Microsoft Advertising API Service.
   Note: the search box does not match App IDs. To search by ID (d42ffc93-c136-491d-b4fd-6f18168c68fd), click the "Application ID starts with" filter pill and enter the ID inside the filter.
3. If the row appears, the setup is complete.

Step 4: Reconnect in Shirofune

Return to Shirofune and try connecting Microsoft Advertising again with the work account you are currently using. If Steps 1 and 2 have been completed, the connection will succeed.

Frequently asked questions

Q. The connection used to work, but this error suddenly started appearing.

The previous connection may have been made with a personal Microsoft account. Personal accounts are not subject to this check, so the error only surfaces when switching to a work account. Please complete the steps above to set up your organization for work-account connections.

Q. I opened the approval link (the URL in Step 2) first, and got the same error.

While the service principal is missing, the approval operation itself fails with the same AADSTS650052 error. Please be sure to perform Step 1 (creating the service principal) first, in order.

Q. I tried to add it via "+ New application" in the Microsoft Entra admin center, but could not find it.

Microsoft first-party applications are not listed in the application gallery and cannot be added manually. Please create the service principal with the command in Step 1.

If the steps above do not resolve the issue

Please contact Shirofune support with the following information.

• If Step 1 failed: the output message of the command
• If an error appeared on the consent screen in Step 2: a screenshot of the screen including the error code
• If Step 2 ended on an error-looking page: the full URL from your browser's address bar (the result of the approval is recorded there)