Check your login email first:

To successfully link your Microsoft Advertising account with Optmyzr, you must use the same login email you use to access the Microsoft Advertising interface directly.

Then check your account type:

Microsoft Advertising accounts can be categorized as either personal accounts (@outlook.com / @live.com) or work accounts (company-managed via Azure AD / Entra). Selecting the wrong type during Optmyzr's connection flow is a common cause of failure.

Password managers (e.g. LastPass, 1Password) and browser autofill can interfere with Microsoft's OAuth redirect — sometimes passing an empty or incorrect email into the URL, which causes a blank screen or silent failure.

Steps to try:

If you see a blank screen after being redirected from Optmyzr, this is typically caused by an empty email being passed in the redirect URL due to autofill or an incorrect browser profile being active. The incognito + correct profile fix above resolves this in most cases.

Microsoft requires Multi-Factor Authentication (MFA) to be active on the account for the OAuth connection to succeed. You may see an error like:

"To enhance the security of your Microsoft Advertising account, Multi-Factor Authentication (MFA) is mandatory when accessing accounts through API. Please ensure that MFA is enabled for your ad account before attempting to link it with Optmyzr."

You can read more about MFA here.

Important: This error can appear even when MFA is already enabled. In that case, it is usually a browser or session issue, not an MFA configuration issue.

Steps to try:

This happens when your Azure AD / Entra tenant has not authorised third-party OAuth apps. You will see a "Need Admin Approval" screen and cannot proceed regardless of your own permission level. You may also see this as "User declined to consent to access the app" (see attached screenshots for reference), in which case your admin would have received an email from Microsoft requesting them to approve access to the app.

How to identify your admin:

Resolution — steps for your IT admin:

If the loop persists after consent is granted, this is a known escalated issue affecting some enterprise Entra tenants. Have your IT admin check:

If it still does not resolve, proceed to Option B in Section 5 — inviting a personal Microsoft account as Super Admin is the most reliable fallback for this scenario.

Note on the admin consent link: In some cases the consent link may not work if the Client ID does not match the tenant's configuration. If this happens, contact support@optmyzr.com to get the correct consent URL for your tenant.

Resetting MFA or recovering Entra portal access is a Microsoft account-recovery process that needs to be handled by your IT team or Microsoft Support directly — it is outside of what Optmyzr can assist with.

However, you do not need to resolve the Entra access issue before connecting to Optmyzr. Optmyzr can connect with any Microsoft sign-in that has access to your Microsoft Ads account. As a workaround, you can invite a different email address to your Microsoft Ads account and use that to connect to Optmyzr instead:

If the standard Microsoft portal (login.microsoftonline.com) shows "no user found" or "we don't recognize this account" even though you can access Microsoft Ads normally, your identity is most likely managed through company SSO (Azure AD, Okta, Google Workspace, etc.) rather than a native Microsoft account. This causes a mismatch during Optmyzr's OAuth flow.

This is a known limitation with Microsoft's OAuth flow for federated identities. Optmyzr is actively working with Microsoft on a longer-term fix. In the meantime, the two workarounds below are the recommended paths.

Google SSO variant: If you log into Microsoft Ads using Google SSO (same email address, but authenticated via Google rather than Microsoft natively), the Microsoft OAuth portal will not recognise your account and may show "Try entering your Microsoft Account again. We don't recognize this one." This is a Microsoft limitation — their OAuth flow only supports native Microsoft accounts. Use Option A or Option B below.

Ask your IT admin to grant tenant-wide consent for Optmyzr:

This can unblock federated users without requiring a separate login. However, this does not work in all SSO configurations — if it doesn't resolve the issue, proceed to Option B.

If you are seeing the error "Lacks service principal," proceed with the steps below.

Check your account type:

This error most commonly affects work accounts. If you're able to switch to a personal account, doing so may resolve the issue immediately.

Check for Microsoft Entra ID (formerly Azure Active Directory):

If your work account is managed via Azure Active Directory:

If your work account is not managed via Azure, contact Microsoft Ads Support and request that the service principal be updated for your Microsoft Ads work account.

If you face any issues after going through these steps, please contact support@optmyzr.com or write to us through the chat box in the interface. If possible, please include: