Microsoft Entra ID Setup

1. Register the Application

In Azure Portal > Microsoft Entra ID > App registrations:

• Name: Adsify API
• Supported account types: Single tenant (or as needed)

2. Configure API Permissions

Expose an API with scopes: ads:read, ads:write, ads:lifecycle

3. Create App Roles

In the app registration, define roles: viewer, operator, admin

Assign roles to users/groups via Enterprise Applications.

4. Configure Adsify

{
  "Authentication": {
    "Authority": "https://login.microsoftonline.com/{tenant-id}/v2.0",
    "Audience": "api://{client-id}",
    "RequireHttpsMetadata": true,
    "RoleClaimType": "roles",
    "ValidIssuers": [
      "https://login.microsoftonline.com/{tenant-id}/v2.0",
      "https://sts.windows.net/{tenant-id}/"
    ]
  }
}

Entra ID places roles in a top-level roles array claim. Set RoleClaimType to roles.

5. Machine Client (Client Credentials)

Create a client secret under Certificates & secrets. AI agents use:

curl -X POST "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" \
  -d "client_id={id}&client_secret={secret}&scope=api://{client-id}/.default&grant_type=client_credentials"