Microsoft Advertising Sandbox API – Error 105 (InvalidCredentials) with Microsoft OAuth

Kamal Behboudi 0 Reputation points
2026-10-15T02:00:10.48+00:00

Hello Microsoft Advertising API Support,

We're experiencing a persistent 105 InvalidCredentials error when calling the Microsoft Advertising Sandbox API using Microsoft OAuth 2.0, despite successful authentication and a valid access token.

Environment:

  • API: CustomerManagement v13 (SOAP and REST)

OAuth flow: Authorization Code

Scope: https://ads.microsoft.com/msads.manage

Developer token: Universal sandbox developer token

Microsoft account: bingads.*****@outlook.com

Sandbox customer ID: 38****47

Sandbox user ID: 28*****00

Investigation performed:

Successfully obtained Microsoft OAuth access tokens with the correct scope.

Verified that tokens are transmitted completely and correctly.

Configured the Entra application, Microsoft Advertising API permissions, and administrator consent.

Tested newly generated tokens, different scopes, and both SOAP and REST endpoints.

Verified the SOAP request structure and authentication headers.

Successfully authenticated against the same sandbox API using Google OAuth.

Using Google OAuth, confirmed that the Microsoft account exists in the sandbox with UserLifeCycleStatus=Active and Super Admin permissions (Role ID 41).

Confirmed that the Outlook user's invitation was accepted and its sandbox account association is active.

Despite these checks, Microsoft OAuth consistently returns:

105 InvalidCredentials: Authentication failed. Either supplied credentials are invalid or the account is inactive.

Tracking IDs:

Failed Microsoft OAuth request: f7846ba2-feb2-45f3-bce6-3762d91461f6

Successful Google OAuth user verification: 6c2cb95e-2906-4ff7-b349-dcbac7c23639

Request:

Could you please investigate whether the failure is caused by Microsoft OAuth token validation, Microsoft-account identity mapping, or a sandbox-side authentication issue?

We've exhausted the standard OAuth configuration and request-format troubleshooting steps. We'd appreciate escalation to the Microsoft Advertising API technical team to identify the underlying cause.

Thank you.Hello Microsoft Advertising API Support,

We're experiencing a persistent 105 InvalidCredentials error when calling the Microsoft Advertising Sandbox API using Microsoft OAuth 2.0, despite successful authentication and a valid access token.

Environment:

API: CustomerManagement v13 (SOAP and REST)

OAuth flow: Authorization Code

Scope: https://ads.microsoft.com/msads.manage

Developer token: Universal sandbox developer token

Microsoft account: bingads.******@outlook.com

Sandbox customer ID: 38*****47

Sandbox user ID: 28*****00

Investigation performed:

Successfully obtained Microsoft OAuth access tokens with the correct scope.

Verified that tokens are transmitted completely and correctly.

Configured the Entra application, Microsoft Advertising API permissions, and administrator consent.

Tested newly generated tokens, different scopes, and both SOAP and REST endpoints.

Verified the SOAP request structure and authentication headers.

Successfully authenticated against the same sandbox API using Google OAuth.

Using Google OAuth, confirmed that the Microsoft account exists in the sandbox with UserLifeCycleStatus=Active and Super Admin permissions (Role ID 41).

Confirmed that the Outlook user's invitation was accepted and its sandbox account association is active.

Despite these checks, Microsoft OAuth consistently returns:

105 InvalidCredentials: Authentication failed. Either supplied credentials are invalid or the account is inactive.

Tracking IDs:

Failed Microsoft OAuth request: f7846ba2-feb2-45f3-bce6-3762d91461f6

Successful Google OAuth user verification: 6c2cb95e-2906-4ff7-b349-dcbac7c23639

Request:

Could you please investigate whether the failure is caused by Microsoft OAuth token validation, Microsoft-account identity mapping, or a sandbox-side authentication issue?

We've exhausted the standard OAuth configuration and request-format troubleshooting steps. We'd appreciate escalation to the Microsoft Advertising API technical team to identify the underlying cause.

Thank you.

PII Removed

Microsoft Advertising API
Microsoft Advertising API

A Microsoft API that provides programmatic access to Microsoft Advertising to manage large campaigns or to integrate your marketing with other in-house systems.

0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. MS Advertising - Chris 0 Reputation points Microsoft External Staff Moderator
    2026-10-15T14:40:51.02+00:00

    Hello Kamal Behboudi,

    Thank you for using our Microsoft Advertising Learn Q&A Platform!

    I appreciate the detailed information you provided regarding the 105 InvalidCredentials error encountered when calling the Microsoft Advertising Sandbox API using Microsoft OAuth 2.0. I can see that you have already performed extensive troubleshooting, including validating the OAuth configuration, access tokens, permissions, request structure, and Sandbox account association.

    Given the steps you have already completed and the behavior observed where authentication succeeds with Google OAuth but fails consistently with Microsoft OAuth, I will be escalating this matter to our Engineering Team for further investigation. I will include the tracking IDs and all relevant details from your post to assist them with their backend review.

    Please allow approximately 5-7 business days for the investigation. If our Engineering Team requires any additional information, I will reach out to you as soon as possible. Likewise, I will provide an update once their findings become available.

    Thank you for your patience and cooperation. We appreciate the thorough details you included, as they will help expedite the investigation process.

    Should you have any additional questions or concerns in the meantime, please feel free to check your Private Messages, as I may use that channel to request further information or provide updates regarding the investigation.

    Best regards,
    Chris | Microsoft Advertising Support Specialist | 1-800-518-5689

    Was this answer helpful?

    0 comments
  2. Kamal Behboudi 0 Reputation points
    2026-10-15T02:03:08.0066667+00:00

    Additional diagnostic information: We successfully retrieved the Outlook user's sandbox record through Google OAuth using CustomerManagement GetUser. The user ID is 282553200, customer ID is 386179947, UserLifeCycleStatus is Active, and RoleId is 41 (Super Admin).

    However, Microsoft OAuth continues to return error 105 with a valid msads.manage token.

    Could the API team inspect tracking ID f7846ba2-feb2-45f3-bce6-3762d91461f6 and determine whether the underlying failure is InvalidAccessToken or UserNotFound? Please also advise which Microsoft login system identifier is needed to investigate the identity mapping.

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-10-15T02:01:15.61+00:00

    Escalate this to Microsoft Advertising Support as a sandbox identity-association investigation, supplying both tracking IDs and the Microsoft Advertising user system identifier so the backend team can distinguish UserNotFound from token or account-state validation.

    Error 105 does not identify a single root cause. It represents AccountInactive, InvalidAccessToken—including credentials for the wrong environment—or UserNotFound.^1^ Your successful token acquisition establishes that the OAuth authorization flow completed, but it does not establish that Microsoft Advertising sandbox resolved that Microsoft identity to the expected sandbox user.

    Submit the escalation

    Contact Microsoft Advertising Support and categorize the case as:

    Microsoft Advertising API → Sandbox → Authentication → Error 105 / Microsoft identity mapping

    Microsoft specifically directs cases involving sensitive account details or unresolved API authentication failures to Advertising Support. For errors 105 and 106, its escalation checklist requests the Microsoft Advertising login system identifier in addition to the request and response evidence.^2^

    Include:

    1. Environment and operation
      • Sandbox
      • Customer Management v13
      • Exact operation used, preferably a minimal GetUser request
      • SOAP and REST both reproduce the failure
    2. Identity information
      • Redacted Outlook login address
      • Confirmation that it is an outlook.com personal Microsoft account
      • Sandbox customer ID and user system identifier
      • Active lifecycle status and assigned Super Admin role
      • Invitation acceptance date/time, if available
    3. OAuth and application information
      • Application/client ID
      • Authorization-code flow
      • Requested scope
      • Token issuance timestamp and expiry—not the access or refresh token
      • Tenant/authority used
      • Entra application’s supported account type
    4. Reproduction evidence
      • UTC timestamp
      • Full sanitized request and response
      • Failed Microsoft OAuth tracking ID
      • Successful Google OAuth tracking ID
      • Statement that the same sandbox user/customer can be queried through Google OAuth
      • Statement that Microsoft OAuth fails consistently through both SOAP and REST
    5. Requested backend checks
      • Resolve the Microsoft token’s identity claims to the sandbox user record.
      • Check whether the sandbox authentication service returns an internal UserNotFound or account-state result.
      • Verify that the Microsoft identity and Google identity are not attached to conflicting sandbox user records.
      • Check service telemetry for the failed tracking ID and compare it with the successful request.
      • Repair or relink the sandbox identity association if it is stale or inconsistent.

    Do not send access tokens, refresh tokens, client secrets, or unredacted authorization headers.

    Why further permission changes are not the next step

    Sandbox requires separate credentials, sandbox endpoints, and—when Microsoft OAuth is used—an MSA created with an outlook.com address. It supports the universal sandbox developer token and requires the application’s own client ID.^3^ Those conditions, plus token transport, invitation acceptance, account status, permissions, SOAP structure, and both endpoint styles, have already been tested.

    Also, insufficient entity authorization normally produces code 106 rather than code 105. An OAuth token carries the same account access and roles that its user has in the Microsoft Advertising UI.^4^ Therefore, repeating administrator consent or assigning Super Admin again is unlikely to discriminate this failure.

    The fact that Google OAuth succeeds does not prove that Microsoft OAuth maps to the same underlying sandbox identity. Microsoft Advertising supports both providers, but the access token represents the selected provider’s user identity.^5^ Only Microsoft Advertising Support can correlate the supplied tracking ID with the backend identity-resolution result.

    References

    1. Bing Ads API Operation Error Codes - Microsoft Advertising API
    2. Handling Service Errors and Exceptions
    3. Microsoft Advertising Sandbox - Microsoft Advertising API
    4. Account Hierarchy and User Permissions
    5. Make your first API call
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.