Artifact Signing organization validation fails after Face Check match; Verified ID share reports Failed

A successful Face Check establishes only that the live-selfie comparison appeared to pass; open a private Azure support request so Microsoft can determine whether the complete Verified ID presentation or the subsequent Artifact Signing organization validation failed.

Distinguish the validation stages

1. Face Check
   • Compares the live selfie with the photo associated with the Verified ID.
   • A successful result produces a match-confidence result as part of the presentation.
   • If the score is below the required threshold, Verified ID returns presentation_error; if Face Check succeeds, its result can be included in a presentation_verified callback. ^1^
2. Verified ID credential presentation
   • This is the complete sharing and validation transaction, not merely the facial comparison.
   • Its documented terminal statuses are:
     • presentation_verified: credential validation completed successfully.
     • presentation_error: an error occurred during presentation. ^2^
   • Therefore, Authenticator showing Failed could indicate that the overall presentation did not complete even though its Face Check substep matched. The exact meaning of that particular activity entry cannot be established from the UI alone; Microsoft must correlate it with service logs.
3. Artifact Signing organization validation
   • This is a separate onboarding decision covering the organization and submitted information. Public Trust requires the identity values to be validated before they can supply the certificate subject attributes. ^3^
   • A browser page saying Verification successful! does not establish that this later organization-level decision completed.
   • If the Artifact Signing status is Failed, and an email-link issue does not explain it, the FAQ says the validation team could not make a determination from the supplied information. ^4^

Request a private backend investigation

1. In the Azure portal, open the affected Artifact Signing account.
2. From its resource menu, select Help → Support + Troubleshooting.
3. Complete the prompts and select Create a support request if the suggested solutions do not resolve it. ^5^
4. Describe the stage sequence precisely:
   • Face Check reported a match.
   • Desktop page displayed Verification successful!
   • Authenticator activity recorded the Verified ID share as Failed.
   • Artifact Signing organization validation later became Failed.
5. Provide privately:
   • Artifact Signing identity-validation/request ID.
   • Subscription, resource group, Artifact Signing account, and tenant details.
   • Exact UTC timestamps and time zone.
   • Screenshots with unnecessary personal data redacted.
   • Whether the primary-contact email link was received and completed, and when.
   • Authenticator incident ID from the next procedure.
6. Enable Advanced diagnostic information if acceptable under the organization’s policy. After creating the case, additional files can be uploaded from All support requests → request → Upload file; exclude identity documents and unnecessary personal information. ^6^

Submit Authenticator diagnostics

On the phone that performed the presentation:

1. Open Microsoft Authenticator.
2. Select Send feedback from the top menu.
3. Select Having trouble?
4. Submit the feedback and logs.
5. Record the generated incident ID and add it to the Azure support case. ^7^

The incident ID—not identity documents, QR codes, verification links, or credentials—is what support needs to correlate the mobile diagnostics.

Conditional checks before resubmitting

• Missed or expired email link: If the primary-contact verification email was missed or its link was not selected within seven days, create a new identity-validation request. A new link cannot be issued for the existing request. The address must not be a distribution list and must accept external messages containing links. ^4^
• Free-hosted contact address: If the primary contact used a free-hosted email address, use an address on the organization’s own domain that is associated with the legal entity. This resolved a closely matching organization-validation failure. ^8^
• Technical presentation failure: For another attempt, fully close Authenticator, update it, clear the browser cache or use another browser, avoid VPN/proxy and weak connectivity, and try another device. ^4^
• Do not create parallel requests while another request remains In Progress or while support is correlating the failed transaction. Additional in-progress requests do not expedite validation. ^4^

References

1. Use Face Check with Microsoft Entra Verified ID
2. Request Service REST API presentation specification
3. Artifact Signing resources and roles
4. Artifact Signing FAQ
5. Create an Azure support request
6. Manage an Azure support request
7. Send Microsoft Authenticator logs and get an incident ID
8. Artifact Signing identity validation failing repeatedly with no reason shown — need backend diagnosis - Microsoft Q&A