Artifact Signing organization verification stuck after CosmosDB 409; verification link already used

For Artifact Signing organization identity validation, the safe recovery path is to create a new identity validation request if the email verification link was already used, expired, failed, or cannot be completed.

Supported recovery steps:

1. Check whether the primary email received the verification message and confirm it was not filtered to Junk/Spam.
2. Verify the primary email address can receive messages from external senders and that messages containing links are not being blocked by mail filtering, firewall, or security policies.
3. If the verification email still cannot be completed, delete the current identity validation request and submit a new one.
4. Do not create multiple in-progress requests for the same entity expecting faster processing; duplicate in-progress requests do not help and cannot be expedited.
5. If the request ultimately shows Failed because email verification was missed or not completed within seven days, a new identity validation request is required.
6. If more help is needed with identity validation, use Azure Support or Microsoft Q&A with the artifact-signing tag.

Important details relevant to this case:

• Verification links sent to the primary email expire after seven days.
• A new link cannot be resent for the same request.
• For organization validation, the request stays In Progress after creation and later moves to Action Required if user action is needed.
• Processing can take 1 to 20 business days, and longer if more documentation is required.

The Cosmos DB HTTP 409 error is not part of the documented Artifact Signing identity validation recovery flow in the available guidance. The documented action for an unusable verification link is to start a new identity validation request after deleting the current one.

References:

• Artifact Signing FAQ
• Quickstart: Set up Artifact Signing