Microsoft Ads Click Fraud: IP Exclusions, the 100-Address Limit and What Works

Microsoft Ads click fraud gets less attention than the Google version, mostly because the budgets are smaller. The clicks are still expensive, though. On legal, insurance and home services terms a single Microsoft click can run well into double digits, and a bot does not care which search engine sold it the ad. What changes is the toolkit. Microsoft gives advertisers a narrower set of controls than Google does, and one of them works very differently from what most people assume.

This guide covers how Microsoft Ads handles IP exclusions, the limits that matter, why no tool can automate the blocking step, and a workflow that still keeps repeat offenders out of your campaigns.

What Counts as Click Fraud on Microsoft Ads

The same things that waste money on Google waste money here. Automated traffic that loads your landing page and leaves. Competitors clicking your ads to drain the daily budget. Click farms and incentivized traffic that look human but never become customers. The difference is where it arrives from. Microsoft search ads run on Bing and on partner properties, so some of your traffic comes from places you never picked by name.

Microsoft does filter a share of invalid clicks on its own and credits them back, the same way Google does. As with Google, you do not see which clicks were caught, and the source is free to keep coming back. The filtering is a floor, not a fence.

How IP Exclusions Work in Microsoft Ads

Microsoft lets you stop your ads from showing to specific IP addresses, and the effect is the same as on Google: the address never enters the auction, so nothing gets billed. The rules around it are tighter than most advertisers expect.

100 entries per campaign. Google allows 500. Microsoft allows 100, and that cap cannot be raised.
Campaign level only. You cannot set exclusions on an ad group, and there is no account-wide list.
IPv4 only. IPv6 addresses cannot be excluded at all.
Wildcards in the last part only. An entry like 203.0.113.* covers 256 addresses. You cannot wildcard any earlier part of the address.

The IPv6 point deserves more attention than it gets. A growing share of mobile and home traffic now arrives over IPv6, and none of it can be blocked this way. In our own data, several of the flagged paid clicks in a single month came from IPv6 addresses. On Microsoft those fall outside the tool entirely.

How to Exclude IP Addresses in Microsoft Ads

The setting lives in the campaign settings, and you can apply one list to many campaigns at once:

Open Campaigns and tick every campaign you want protected.
Click Edit, then Other changes.
In the campaign settings list, choose IP address exclusions.
Paste your list, one entry per line, and save.

Microsoft accepts any valid address without checking whether it ever clicked your ads. A typo blocks a stranger. A careless range blocks a whole office or a mobile carrier gateway. With only 100 slots, every entry has to earn its place.

Why No Tool Can Automate Microsoft Ads IP Blocking

On Google Ads, software can write exclusions into a campaign through the Google Ads API. That is how automated click fraud protection works there: the tool finds the bad source and adds it to your list without you touching anything.

Microsoft Advertising offers no API for IP exclusions. The setting exists in the interface and nowhere else. Every click fraud product in this category runs into the same wall, which is why they all do the same thing on Microsoft: watch the traffic, flag the bad sources, and hand you a list to paste. Any tool that claims automatic IP blocking on Microsoft Ads is worth a direct question about how it does it.

That does not make protection pointless. It moves the work. The detection is still automated. The last step, pasting the list, is yours.

A Workflow That Fits Inside 100 Entries

A hundred slots fill up fast if you add addresses as you find them. The trick is to treat the list as a ranked, rotating set rather than a pile.

Rank by damage, not by date

The address that clicked your ads eleven times this month matters more than the one that clicked once in June. Keep the worst offenders by flagged clicks, and let the rest fall off. A list sorted by recency alone wastes slots on one-time visitors who were never coming back anyway.

Collapse clusters into ranges, carefully

When several flagged addresses sit in the same block, one wildcard entry can replace them all and free up slots. The risk is that the block also holds real customers. Only collapse a block when none of its addresses sent you a clean click. If a block has produced both junk and a genuine lead, list the bad addresses one by one instead.

Refresh on a schedule

Addresses move. Residential connections get reassigned and bot operators rotate through pools. A list pasted in March and never touched is protecting you from last season's traffic. Replace it weekly with the current top 100.

Make sure you can see Microsoft clicks at all

None of this works unless your tracking can tell a Microsoft ad click apart from other visits. Turn on auto-tagging of the Microsoft Click ID in your account settings. Every ad click then arrives with an msclkid value on the URL, which is how a click gets tied back to the ad that produced it. If you tag URLs by hand instead, use consistent UTM values such as utm_source=bing and utm_medium=cpc.

What IP Exclusions Cannot Do on Microsoft

The limits are worth stating plainly, so the list is judged against the right expectations:

It cannot stop the first click from a brand new source. Something has to click before anything can judge it.
It cannot touch IPv6 traffic.
It cannot keep up with a determined operator who changes address on every visit.
It cannot recover money already spent. Refunds are Microsoft's decision under its own invalid traffic policy.

What it does well is stop the repeat offenders: the competitor on a fixed office connection, the data center range that keeps sending headless browsers, the handful of addresses that account for a surprising share of your junk clicks. On most accounts that is where the money leaks.

How Block Click Fraud Handles Microsoft Ads

Block Click Fraud treats Microsoft Ads as monitoring plus a block list. Every Microsoft Ads click on your site is checked the same way Google clicks are, and each one gets a verdict of clean, suspect or fraud with the reason attached. Your dashboard then builds the paste-ready list for you: up to 100 IPv4 entries, ranked by flagged clicks, with blocks collapsed to a wildcard only where no clean click came from them. Copy it, paste it into the campaign settings, and refresh it weekly.

On Google Ads the same checks feed straight into your exclusion lists with no pasting at all. The comparison is laid out in how Block Click Fraud works, and the plans are on the pricing page.