Share via

Developer Token Authorization Issue - UserIsNotAuthorized for Write Operations

Scott Bradley 0 Reputation points
2025-07-25T18:49:19.1633333+00:00

Issue Summary

Our Microsoft Advertising API developer token allows read operations but fails on write operations with error code 106 "UserIsNotAuthorized - The user does not represent a authorized developer."

Account Information

  • Azure App Registration: Configured with Microsoft Advertising API Service permissions
  • OAuth Scopes: https://ads.microsoft.com/msads.manage

Technical Details

Working Operations (Read Access)

  • ✅ GetUser - Customer Management Service
  • ✅ GetSharedEntitiesByAccountId with SharedEntityType='NegativeKeywordList' - Campaign Management Service

Failing Operations (Write Access)

  • ❌ AddSharedEntity with PlacementExclusionList - Campaign Management Service
  • ❌ GetSharedEntitiesByAccountId with SharedEntityType='PlacementExclusionList' - Campaign Management Service

Error Details

Primary Error:

  • Error Code: 106
  • Error Type: UserIsNotAuthorized
  • Message: "The user does not represent a authorized developer"
  • Latest Tracking ID: 37c228a9-58c1-41df-938e-0d9e0dc19509

Secondary Error (PlacementExclusionList specific):

  • Error Code: 4303
  • Error Type: CampaignServiceSharedEntityInvalidType
  • Message: "The specified shared entity type is invalid or not currently supported"
  • Tracking ID: 85aaa2fc-ce62-4484-9200-5b72fe1c5a27

SOAP Request Details

Headers Used:

  • AuthenticationToken
  • CustomerId
  • CustomerAccountId
  • DeveloperToken

API Endpoints:

  • Customer Management: https://clientcenter.api.bingads.microsoft.com/Api/CustomerManagement/v13/CustomerManagementService.svc
  • Campaign Management: https://campaign.api.bingads.microsoft.com/Api/Advertiser/CampaignManagement/v13/CampaignManagementService.svc

Developer Token Status

The Microsoft Advertising Developer Portal (accessed through ads.microsoft.com → Tools → API Center) shows our developer token` but provides no status information, approval state, or indication of authorization level.

OAuth Authentication Flow

  • OAuth2 flow completes successfully
  • Access tokens are valid and work for read operations
  • User has Super Admin role in Microsoft Advertising account
  • Azure AD app registration includes Microsoft Advertising API Service with msads.manage permissions

Specific Questions for Microsoft Support

  1. Developer Token Authorization: Why does our developer token allow read operations but fail write operations with "UserIsNotAuthorized"?
  2. PlacementExclusionList Support: Is PlacementExclusionList supported for regular advertiser accounts, or only for manager accounts? Our account shows error 4303 when accessing this entity type.
  3. Account Type Requirements: Does creating placement exclusion lists require a specific account type or additional permissions beyond standard Microsoft Advertising access?
  4. Token Approval Process: Is there an approval process for developer tokens to gain write access that isn't visible in the developer portal?

Business Context

We are implementing URL placement management for advertising campaigns. Our application needs to:

  • Create placement exclusion lists programmatically
  • Add negative sites to prevent ads from appearing on specific domains
  • Manage these lists across multiple advertising accounts

Troubleshooting Already Completed

  • ✅ Verified OAuth2 authentication works correctly
  • ✅ Confirmed developer token is properly configured
  • ✅ Tested with correct Customer ID from Microsoft Advertising account
  • ✅ Verified Azure app permissions include Microsoft Advertising API Service
  • ✅ Confirmed read operations work (proving authentication is valid)
  • ✅ Used proper SOAP headers and request structure per API documentation
  • ✅ Tested with zeep SOAP client library
  • ✅ Verified all environment variables and configuration

Expected Resolution

We need our developer token to be authorized for write operations, specifically:

  • AddSharedEntity for creating placement exclusion lists
  • AddListItemsToSharedList for managing negative sites
  • Other Campaign Management write operations as needed

Contact Information

Please respond with:

  1. Steps to authorize our developer token for write operations
  2. Clarification on PlacementExclusionList availability for our account type
  3. Any additional account setup required for placement exclusion list management

Thank you for your assistance in resolving this API authorization issue

Microsoft Advertising API
Microsoft Advertising API
A Microsoft API that provides programmatic access to Microsoft Advertising to manage large campaigns or to integrate your marketing with other in-house systems.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. MS Advertising - Jefferson 155 Reputation points Microsoft External Staff Moderator
    2025-07-25T21:03:23.2533333+00:00

    Hi Scott,

    Thank you for reaching out to the Microsoft Advertising Learn Q&A Platform! My name is Jefferson, and I will be assisting you with this query.

    It seems like you're running into an issue with your Microsoft Advertising API developer token, specifically getting a "UserIsNotAuthorized" error when trying to perform write operations. Below are some insights and guidance to help resolve this:

    1. Developer Token Authorization: Why does our developer token allow read operations but fail write operations with "UserIsNotAuthorized"? Answer: The error may occur if the user associated with the token does not have sufficient permissions (e.g., not a Super Admin on Microsoft Advertising account). Resource: Account Hierarchy and User Permissions - Microsoft Advertising API | Microsoft Learn
    2. PlacementExclusionList Support: Is PlacementExclusionList supported for regular advertiser accounts, or only for manager accounts? Our account shows error 4303 when accessing this entity type. Answer: The PlacementExclusionList is only supported at the manager account level. It is part of the shared library that manager accounts use to manage website exclusions across multiple linked advertiser accounts. For regular advertiser accounts, Microsoft Advertising provides the AccountPlacementExclusionList entity type instead. This is the account-level version of the exclusion list. You can use it to exclude placements at the account level without needing manager-level privileges Resources:
    3. Account Type Requirements: Does creating placement exclusion lists require a specific account type or additional permissions beyond standard Microsoft Advertising access? Answer: Only the users of the manager account (customer) that owns a website exclusion list (PlacementExclusionList) can update or delete the list, add or delete list items, and associate the list with ad accounts. If your ad account is associated with a website exclusion list that you do not own, you can disassociate the list from your account, but the list and list items are read-only. The owner of the list is determined by the association's SharedEntityCustomerId element. Resource: AddSharedEntity Service Operation - Campaign Management - Microsoft Advertising API | Microsoft Learn
    4. Token Approval Process: Is there an approval process for developer tokens to gain write access that isn't visible in the developer portal? Answer: Similar to the answer on the question #1. The user associated with the token must have Super Admin privileges in the Microsoft Advertising account. You can read more here: Get Started With the Bing Ads API - Microsoft Advertising API | Microsoft Learn

    Our support teams are happy to discuss your account in more detail via phone, chat or email to provide review assistance, please see our support page to reach out! 

    I hope this information helps. If you have any additional questions, please do not hesitate to reach out to our support. I have also sent you a PM in case you have any questions.

    Kind regards,

    Jefferson | Microsoft Advertising Support Specialist | 1-800-518-5689

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.