msads.manage marked as "Admin consent required" — does this block personal Microsoft accounts (MSA) from self-consenting?

I'm building a third-party integration with the Microsoft Advertising API (Customer Management API v13, REST) and consistently get a 401 error on GetUser and GetAccountsInfo:

Code: 105

ErrorCode: InvalidCredentials

Message: "Authentication failed. Either supplied credentials are invalid or the account is inactive"

Environment: Production (not sandbox).

What I've already verified:

• OAuth flow (login.microsoftonline.com, /common endpoint) completes successfully and returns access_token/refresh_token/id_token.
• Scope requested: openid profile email offline_access https://ads.microsoft.com/msads.manage
• Reproduced the exact same error with raw curl (no SDK, no custom code involved), ruling out an implementation bug.
• The Microsoft Advertising account being tested is active (has a real, existing campaign, just paused due to missing payment method).
• Developer Token value was copied correctly from the Developer Portal (no whitespace issues), shows no pending/approval status.
• Waited 30+ minutes in case of account/token propagation delay — no change.
• Generated a brand-new Developer Token directly from the same test account — same error persists.

Key finding: In my Azure app registration's API permissions, both ads.manage and msads.manage (Microsoft Advertising API Service, delegated permissions) are marked as "Admin consent required: Yes". They show "Granted for <my own tenant domain>" — admin consent was granted, but only within my own organization's tenant.

When I test OAuth with an external PERSONAL Microsoft account (e.g. outlook.com, tid = 9188040d-6c67-4c5b-b112-36a304b66dad, the well-known "consumers" tenant), the consent screen only shows "View you your email address" — it never mentions or requests theMicrosoft Advertising permission at all. The resulting tokenoes "https://ads.microsoft.com/msads.manage", but callingGetUser/GetAccountsInfo with it always fails with the Code 1

                                                                                                                                               My question: Is `msads.manage` intended to require admin conpp, or is this specific to how my app was configured? If itdoes require admin consent:                                                                                                                        

1. For personal/consumer Microsoft accounts (MSA), which have no tenant or administrator at all, is there any way for them to grant consent to an admin-restricted permission? Or are personal accounts simplyanage?2. For external organizational accounts (different companiesthe /common/adminconsent flow lets their own tenant adminapprove my app once — is that the only supported path, or is.manage self-consentable by individual non-admin users (likethe officially documented "Request user consent" flow seems

Given that third-party Microsoft Advertising management tools clearly support arbitrary individual advertisers (including personal accounts) connecting their own accounts without needing their own IT admin involved, I must be missing some configuration step. Any guidance on the correct

setup would be greatly appreciated.

TrackingIds from failed attempts:

309a1a48-1236-453c-acd3-df1964c6d42d

81a866da-6fe1-40fa-950f-88db81f10ad8

ae973b3b-44fa-4c84-b90d-c71744a53df8

9182b47e-d346-4e6b-ad1b-e7d69c20c142