LinkedIn Ad Account Roles and Permissions for MCP Access

Access is two layers, not one

LinkedIn advertising access is controlled by two independent systems that both have to line up before anything works. The first is the platform role a user holds inside Campaign Manager (or, for larger organizations, inside Business Manager). The second is the set of OAuth scopes granted when that user authorizes an application through LinkedIn's Marketing Developer Platform.

An MCP connection is an OAuth app acting on behalf of a specific person. Its effective permission is the intersection of that person's role and the token's scopes. A user with full account control but a token limited to read-only scopes can still only read. A token requesting write scopes cannot exceed what the underlying role allows. Both dials have to be turned up before your assistant can change a campaign.

LinkedIn ad account roles, from read-only to full control

Inside Campaign Manager, open the account, go to Settings, then Manage access. Each user gets exactly one of these roles on that account:

• Viewer, sees campaigns, creatives, and reporting. Cannot change anything. This is the safe default for a monitoring-only connection.
• Creative Manager, can create and edit creatives, plus everything a Viewer can do. No control over campaign structure or budgets.
• Campaign Manager, can create and edit campaigns and creatives and adjust budgets and bids. This is the role most people mean when they say they want an assistant to 'run' the account. It cannot manage users or billing.
• Account Manager, full control, including adding and removing other users and changing their roles. Grant this sparingly.
• Billing Admin, manages payment methods and billing details. Assigned on top of another role rather than instead of it.

The OAuth scopes an MCP requests

When you connect an Ads MCP, LinkedIn shows a consent screen listing the scopes the app is asking for. For advertising work the relevant ones are narrow and specific:

• r_ads_reporting, read analytics and performance data. Enough for a reporting or monitoring assistant.
• r_ads, read ad accounts, campaign groups, campaigns, and creatives. Read-only structural visibility.
• rw_ads, read and write ad structure: create, edit, pause, and manage campaigns and creatives. This is the scope that makes an assistant able to change things.

Mapping roles and scopes to what the assistant can do

Think of it as a grid. The role sets the ceiling; the scope sets what the token reaches for within that ceiling. A read-only monitoring setup pairs a Viewer role with r_ads_reporting and r_ads. A hands-on setup that drafts and edits campaigns pairs a Campaign Manager role with rw_ads. There is deliberately no path where a Viewer-role token can write, no matter which scopes are requested, LinkedIn's API rejects the write.

A well-built MCP adds a third safeguard on top of LinkedIn's two layers: it plans changes as a dry run and waits for explicit approval before any write call goes out. That approval gate is the same discipline we describe for running Google Ads from Claude, and it matters more on LinkedIn because ad spend there is expensive to get wrong.

Setting up least-privilege access

The goal is to grant the smallest role and the fewest scopes that let the assistant do its job, and nothing more. A practical sequence:

• Decide read-only versus hands-on first. Most teams start read-only and only add write access once they trust the workflow.
• Create or use a dedicated user identity for the connection rather than authorizing with a personal admin account, so revoking access later is clean.
• Assign the matching role in Campaign Manager: Viewer for reporting, Campaign Manager for hands-on work. Skip Account Manager unless the assistant genuinely needs to manage users.
• At the consent screen, confirm the scopes match the intent, reject a rw_ads request if you only wanted reporting.
• Review connected apps and account users on a schedule, and revoke tokens the moment a workflow is retired.