Artifact Signing individual identity

Because the personal Microsoft account email already matches the individual request’s billing-derived primary email, open an Azure Support case for the blocked identity validation instead of creating another user, changing tenants, or submitting duplicate requests.

Escalate the matching-email failure

The documented individual workflow requires signing in to the verification link with the same email address recorded as the request’s primary email. That address is populated from the selected individual billing account and is read-only in the request.^1^

Microsoft’s FAQ attributes “You don't have permission to access this page” to different request and sign-in email addresses.^2^ Since those addresses match in this case—and the Identity Verifier role, private browsing, and a directory member have already been tested—the documented mismatch correction does not resolve the failure.

1. In the Azure portal, open Help + support and create an Azure support request.
2. Select the Artifact Signing service and describe the issue as:
   • Public individual identity validation
   • Personal Microsoft account
   • Verification page displays “You need permission”
   • The displayed tenant is Microsoft Accounts
   • The sign-in email exactly matches the request’s billing-derived primary email
3. Provide privately in the support case:
   • Identity validation ID
   • Subscription ID
   • Artifact Signing account name and resource ID
   • Request status
   • UTC timestamp of the latest failed attempt
   • Screenshot showing the error and displayed tenant
   • Confirmation that AU10TIX verification completed and the Verified ID exists in Authenticator
4. Ask support to investigate why the matching personal account is rejected by the presentation page and whether the request requires service-side correction.

Support-side unblocking or resetting cannot be performed from the portal by the user and is not guaranteed. Azure Support and Microsoft Q&A with the artifact-signing tag are the documented assistance channels; creating more requests for the same entity while one is in progress does not help.^2^

The Microsoft Accounts tenant label alone does not establish that an Entra work account is required for this step. The individual workflow specifically instructs the applicant to use the primary email to sign in to the Microsoft Account that opens the validation link.^1^ Creating a member user cannot substitute for that billing-derived identity.

Optional client-side checks

These are non-decisive checks to perform while opening the case:

• Fully close every Microsoft Authenticator instance and reopen it.
• Update Authenticator to the latest Android or iOS version.
• Disable VPN or proxy connections.
• Try presenting the Verified ID from another supported mobile device.

These are Microsoft’s general troubleshooting steps for technical failures involving Authenticator and Verified ID.^2^

Remove the mistaken organization request

An identity validation can be deleted only when it is not in the In Progress state:

1. Open Artifact Signing account → Objects → Identity Validation.
2. Select the organization request.
3. If Delete is available, select it and review the listed linked accounts and certificate profiles.
4. Confirm deletion.

Deletion is permanent, and deleting a validation linked to certificate profiles can affect signing and certificate renewal.^3^

If the mistaken request remains In Progress, include it in the same support case because the portal does not permit deletion in that state.

References

1. Quickstart: Set up Artifact Signing
2. Artifact Signing FAQ
3. Renew or delete Artifact Signing Identity Validations