Artifact Signing organization validation failed after Authenticator 504 / noaccess

If the 6 October action-required email contained the verification link, that link expired on 13 October and the failed request cannot receive a replacement link; because the replacement will use a different primary email, Microsoft support must first clear or authorize the new request.

What to do now

1. Do not submit another request yet.
   Artifact Signing requires support involvement when an identity validation already exists for an organization and another request must use a different primary email. Creating additional requests for the same entity does not help while one is still being handled.^1^
2. Use this Microsoft Q&A case as the supported escalation path.
   The FAQ lists either Azure Support or Microsoft Q&A with the Artifact Signing tag for identity-validation assistance.^1^ Since the Basic support plan does not permit the required technical case, a moderator will need to engage the Artifact Signing validation team. Do not post subscription IDs, validation IDs, tenant IDs, or company documents publicly; provide them only through a private channel requested by Microsoft staff.
3. Provide the validation team with:
   • Artifact Signing account name and Azure region.
   • Validation request ID and subscription ID.
   • Exact UTC timestamps for the October 6 and October 22 events.
   • The Authenticator 504 and final credentials.microsoft.com/verify/noaccess result.
   • Copies of the Microsoft and AU10TIX email subject lines.
   • Whether the October 6 message contained the link used on October 22.
   • Confirmation that the proposed replacement primary address is a monitored mailbox on the company-owned domain.
   • A request to confirm whether the existing organization record must be cleared before resubmission with the new address.

The portal’s generic Failed state does not identify whether the rejection occurred during the Verified ID handoff, representative verification, or organization review. Microsoft’s validation team must inspect the request records to distinguish those outcomes. Similar silent failures are handled through Azure Support because the portal does not expose the rejection reason.^2^

Expiry versus the Authenticator 504

Artifact Signing verification links expire after seven days. When a link expires, it cannot be resent for the same request; a new identity-validation request is required.^1^

Therefore:

• If the link used on October 22 came from the October 6 email, expiry alone requires replacement, regardless of the subsequent 504.
• If a fresh link was issued on October 22, the timeline does not prove expiry. The 504/noaccess sequence requires backend diagnosis and should not be treated as evidence that the representative or business validation itself failed.
• Because the portal already shows Failed, repeatedly opening the same link is not a documented recovery method.

Requirements for the replacement

Create the replacement only after Microsoft confirms that the existing organization/email association no longer blocks it:

1. Azure portal → Artifact Signing account → Objects → Identity validations.
2. Select Organization → New Identity → Public.
3. Use the exact legal entity name, business identifier, registered address, and representative name shown on the representative’s government ID.
4. Set Primary Email to a monitored address on a domain owned by the legal entity. The secondary address must differ from the primary address, and for an organization its domain must match the primary address’s domain.
5. Ensure both mailboxes accept messages containing external links.
6. Complete each emailed action within seven days.^3^

Changing information after creation requires a new validation request; the existing failed request is not edited in place.^3^

Reusing the Verified ID

A valid, unexpired Verified ID can be presented for Artifact Signing; creating another Verified ID is not inherently required.^1^ Ask the validation team whether the failed presentation consumed or invalidated this particular workflow before removing the credential or repeating identity proofing.

If Microsoft instructs you to retry because the failure was technical, first close all Authenticator instances, update Authenticator, use an updated browser or another browser/device, and avoid VPN, proxy, or weak connectivity. Those are documented technical-error steps, but they do not reset a request already marked Failed.^1^

References

1. Artifact Signing FAQ
2. Trusted Signing: Public Trust organization identity validation keeps failing for a recently incorporated EU company - what makes it pass? - Microsoft Q&A
3. Quickstart: Set up Artifact Signing