What MCP is and why it matters for ad operations
Model Context Protocol (MCP) is a standard interface specification that defines how an AI assistant connects to an external data source. Anthropic published it. The protocol defines a request-response schema: the assistant asks for data in a structured way; the server responds in a structured way. Any assistant that supports MCP tool-calling can connect to any MCP server, regardless of who built either side. This is what makes the architecture interesting for advertising.
Before MCP, connecting an AI assistant to campaign data required either a proprietary API integration built for a specific platform-to-tool pairing, or a third-party connector with its own data-handling behaviour and latency. The MCP standard collapses that into a single protocol. Microsoft Advertising building a server to that spec means any compliant assistant, Claude, ChatGPT, M365 Copilot, or a custom-built agent, can read your campaign data through a single, vendor-supported connection point.
The significance of this being a first-party integration matters more than it might appear. Third-party connectors exist for most platforms today. But a first-party MCP server means the platform vendor controls the data schema, the authentication mechanism, the refresh cadence, and the data residency boundaries. Those are not small things when the data flowing through the connection is live campaign spend data for regulated-sector clients.
| Integration type | Who builds the connector | Data schema control | Auth and residency | MCP-compatible |
|---|---|---|---|---|
| Third-party API wrapper | Vendor or agency | Third party | Third party | Not inherently |
| Platform proprietary API | Platform (e.g. Google Ads API) | Platform | Platform | Not inherently |
| First-party MCP server (Microsoft Advertising) | Platform vendor | Platform vendor | Platform vendor | Yes, any MCP-compatible assistant |
What the read-only pilot can and cannot do
Microsoft Advertising's own announcement on 17 June 2026 describes the pilot as "expanding to open pilot with read-only access," giving businesses and agencies the ability to "build custom AI workflows grounded in live campaign data." The read-only boundary is the defining constraint for everything that follows.
What read-only access enables: the connected assistant can retrieve and surface live campaign data, performance metrics, spend levels, impression and click volumes, campaign status, audience segment data, and reporting across dimensions that the Advertising API exposes. An ops team member can ask the assistant to summarise last week's performance across all search campaigns, compare spend against plan, or flag campaigns where the click-through rate (CTR) has dropped below a threshold. The assistant answers from live data without the team member needing to open a separate reporting interface.
What read-only access cannot do: the assistant cannot write anything back. No bid changes. No budget adjustments. No campaign pausing or activation. No ad copy edits. No audience list modifications. No automated rule creation. If the assistant surfaces an anomaly, a human must take the action. This constraint is the right design for a pilot. It limits blast radius while the industry learns what the connection is actually useful for.
| Action category | Possible in read-only pilot | Notes |
|---|---|---|
| Retrieve campaign performance data | Yes | Live data via the Advertising API |
| Compare periods, segment, summarise | Yes | Assistant handles the analysis in natural language |
| Flag anomalies against a threshold | Yes | Requires the assistant to be prompted with threshold context |
| Change bids, budgets, or audiences | No | Read-only boundary. Human action required. |
| Pause or activate campaigns | No | Write access not available in current pilot |
| Edit ad copy or creative assets | No | Write access not available in current pilot |
| Create automated rules or workflows that execute | No | The MCP connection surfaces data; execution stays with the human |
How the connection works: the flow from assistant to account
The diagram below shows the three-node architecture. The read-only boundary sits between the MCP server and the Microsoft Advertising account, not between the assistant and the server. An assistant with a write-capable future MCP connection would cross that boundary. The current pilot does not.
Authentication flows through the MCP server, not the assistant. The assistant does not hold your Microsoft Advertising credentials. The server handles authentication on your behalf, which means the security model is closer to an authorised API connection than to a user logging in through an AI. How your organisation manages that service credential, and who can revoke it, are the two most consequential governance questions for the pilot period.
The data returned by the server is live, not cached from a yesterday-morning pull. This matters for anomaly detection: an ops team member asking "is anything unusual happening in campaign X right now?" gets an answer grounded in today's data, not last night's export. For a team running daily budget management across multiple Microsoft Advertising accounts in Singapore, Australia, or Canada, that real-time read layer has genuine value.
What your ops team should actually build with this
Three workflows are worth building with the read-only pilot. One is immediately useful. Two are preparation for the write-capable phase that follows.
Workflow 1: Morning performance briefing. Your M365 Copilot or Claude instance, connected to the MCP server, generates a natural-language summary of overnight performance across all campaigns every morning. Spend vs plan, top performers, underperformers, anomalies against a threshold you set in the prompt context. The daily reporting work that currently takes 20-40 minutes of an analyst's morning becomes a 2-minute read. This is the workflow worth standing up in the first week of the pilot.
Workflow 2: Anomaly triage with an escalation script. Configure the assistant to surface campaigns that breach defined thresholds (cost per acquisition above plan by more than 20%, impression share below a floor for a key search term, spend rate putting monthly budget at risk before month-end). The assistant reads the data and formats the finding; a human decides whether to act. The ops value here is not the decision, it is the guaranteed monitoring. An assistant that checks thresholds on a defined schedule removes the dependency on a human remembering to look.
Workflow 3: Prompt library for write-phase readiness. The write-capable version of this server will let the assistant make changes, moving beyond read-only data retrieval. Build your prompt library now, while the boundary is read-only and mistakes are informational rather than executed. Test how the assistant interprets your briefing language. Establish which phrasings produce reliable structured outputs. Find the ambiguity in your operating procedures before those procedures have consequences. When write access arrives, your ops model should already be tested.
| Workflow | Build now (read-only) | Wait for write-capable | Never hand to an agent |
|---|---|---|---|
| Daily performance summary | Yes | ||
| Anomaly flagging with threshold alerts | Yes | ||
| Prompt library and escalation protocol | Yes | ||
| Routine bid adjustments within tested range | Yes, after governance reviewed | ||
| Budget reallocation across campaigns | Yes, with human-in-loop approval step | ||
| Ad copy changes without human review | Yes | ||
| Audience exclusion changes in regulated sectors | Yes, pending regulator guidance | ||
| Campaign-level strategy changes (match type, bidding mode) | Yes, keep human decision authority |
The AI performance marketing work we run for clients in Singapore and Australia separates the reporting and monitoring layer from the execution layer. The MCP connection sits cleanly in the monitoring layer. Execution, especially for financial-sector campaigns where compliance review is part of the change process, stays human until the audit trail for agent-executed changes is established and regulator-acceptable.
Governance questions to answer before you connect
The read-only pilot has a low blast radius. But good governance habits built during the read-only phase are the habits that prevent incidents when write access arrives. Seven questions to resolve before you connect the server to a production account.
Expand: 7 governance questions before connecting the MCP server
-
Access scope: who can use the assistant with the MCP connection active? Define the minimum necessary access. Not everyone with a Copilot or Claude subscription needs the ad account data connection. Tie MCP access to the same access-control list as your Microsoft Advertising account login.
-
Authentication model: service account or named user credential? A service account is auditable and revocable independently of any individual. A named user credential creates a dependency: that person's departure or role change affects the connection. For a production account, service account is the right choice.
-
Audit logging: is every query logged, and who can review the log? For financial-sector advertisers in Singapore (PDPA), Australia (Privacy Act), Canada (PIPEDA), and the United States, logging is not optional. Confirm that the MCP server's access log is available, retained to your required period, and accessible to your compliance team.
-
Data residency: where does the AI assistant process the data it receives? The MCP server sends campaign data to the AI assistant. The assistant processes it. Where that processing occurs depends on your assistant subscription and regional configuration. For M365 Copilot with EU or SG data residency commitments, confirm the data does not leave the designated region. For ChatGPT Enterprise, review the data processing agreement. For Claude for Work, review Anthropic's regional data terms.
-
Training data: does your assistant subscription guarantee data-not-used-for-training? Consumer-tier subscriptions (ChatGPT free, Claude.ai free) may use conversation content for model training. Enterprise subscriptions typically exclude this. Verify the guarantee covers data received via MCP tool calls, and direct user messages separately.
-
Escalation path: when the assistant flags an anomaly, who acts and in what time window? A morning briefing that flags a budget anomaly at 07:00 is useful only if someone is accountable for reviewing it before the day's spend commits. Define the response SLA and the escalation chain before you switch on the monitoring workflow.
-
Write-access governance: how do you prevent a write-capable version from being connected before your governance is updated? The pilot is read-only today. Microsoft will expand capabilities. Set a policy now: no write-capable MCP connection to a production account without a governance review that addresses items 1-6 again under write conditions. The read-only phase is the planning window for the write-phase governance document.
For leapbuzz clients running Microsoft Advertising spend across Singapore, Australia, and Canada simultaneously, the data residency question (item 4) is the most complex. A single MCP connection routes data from accounts in multiple jurisdictions through a single assistant endpoint. Singapore's Personal Data Protection Act (PDPA), administered by the Personal Data Protection Commission, imposes transfer-limitation obligations that apply when personal data moves to an AI system's processing infrastructure outside Singapore. Review your data processing agreements per market before connecting a multi-market account structure.
The AI marketing strategy work we do covers exactly this layer: which AI tools to connect, and what governance, audit, and escalation infrastructure needs to be in place before that connection goes live.
What this signals for Google and Meta
Microsoft moved first on a first-party MCP server. No other major ad platform, including Google Ads, Meta Ads Manager, or TikTok for Business, had published an equivalent as of 17 June 2026. The question for every advertiser running multi-platform budgets is how long that gap persists.
Google and Meta's current agentic moves are oriented inward, not outward. Google's AI Max campaign features and Meta's Business Agent (announced June 3, 2026) both place AI capability inside the platform interface. The agent helps you inside Google Ads or inside Meta Ads Manager. Neither platform has announced a mechanism for bringing campaign data to the AI assistant environment where the buyer's workflows already run.
The architectural difference matters. Microsoft's MCP approach says: your AI assistant lives in M365 Copilot or Claude, and we will bring the ad data to you. Google's and Meta's in-platform AI approach says: come into our interface and we will help you there. These are not competing on the same axis. They reflect different views of where the "centre of gravity" for marketing work will sit as AI assistants become a primary work interface for ops teams.
| Platform | AI integration approach | Data goes to external assistant | First-party MCP |
|---|---|---|---|
| Microsoft Advertising | MCP server (open pilot, 17 Jun 2026) | Yes, via MCP | Yes |
| Google Ads | AI Max in-platform AI features | No public announcement | No |
| Meta Ads Manager | Meta Business Agent (3 Jun 2026) | No public announcement | No |
| TikTok for Business | Smart+ automation (in-platform) | No public announcement | No |
| LinkedIn Ads | AI creative tools (1 Jul 2026) | No public announcement | No |
If AI assistants (Copilot, Claude, ChatGPT Enterprise) consolidate as the primary interface where marketing teams work over the next 12-18 months, the platform that already has a production MCP integration has a structural advantage: its data is already where the operator is. The others will need to build catch-up integrations or argue that their in-platform AI is the interface worth switching to.
For Microsoft Advertising accounts, the MCP server is a reason to lean into the platform's reporting and monitoring capabilities now, while the first-mover advantage is real. For Google Ads and Meta accounts, the playbook is to watch the 6-month window and plan for MCP equivalents to arrive; build the governance framework now so you can move fast when they do.
The Microsoft Ads and LinkedIn B2B targeting post covers the structural advantages of the Microsoft ecosystem for B2B advertisers. The MCP server adds an ops-infrastructure layer on top of that positioning. For B2B teams already invested in the Microsoft environment, the integration cost of adding MCP to an existing M365 Copilot subscription is minimal.
