Does Artifact Signing GA require three years of business or tax history for U.S. Organization Public Trust validation?

Question

Does Artifact Signing GA require three years of business or tax history for U.S. Organization Public Trust validation?

Eric Lievers 0

A newly formed U.S. LLC submitted an Organization / Public identity validation for Azure Artifact Signing. The representative’s Microsoft Verified ID / personal credential verification completed successfully, but the organization validation changed to Failed without a specific reason in the Azure portal or email.

Azure’s built-in diagnostics confirm that the Artifact Signing account itself is healthy, was provisioned successfully, and has no outage, deployment, activity-log, or resource-health failure. The exact backend rejection reason is not exposed.

Current Microsoft documentation appears inconsistent. The current Artifact Signing quickstart does not state a minimum organization age, while Microsoft’s current MSIX signing overview says organizations must have a verifiable tax history of three or more years. Older Microsoft guidance also described a three-year requirement, while a Microsoft staff response in August 2026 reportedly stated that Artifact Signing has no minimum organization-age restriction.

Could an Artifact Signing product-team member please confirm:

Does U.S. Organization / Public Trust validation under Artifact Signing GA currently enforce a minimum incorporation age or three years of verifiable business/tax history?
Which current Microsoft policy or documentation controls this requirement?
If a newly formed organization can qualify, what exact public records or business evidence are accepted?
How can a Basic-support customer privately provide the validation identifier and legal documents for review without publishing them here?
Is there a no-additional-cost private escalation path for Microsoft to identify the exact validation deficiency before another validation request is submitted?

We will not post subscription IDs, tenant IDs, validation IDs, street addresses, government IDs, or private business documents publicly. We are specifically requesting a secure private review path and will not submit another validation request until Microsoft identifies what must be corrected.

0 comments

1 answer

Your answer

Answer 1

Do not submit another validation request yet; the published Microsoft sources conflict on the three-year requirement, so only Artifact Signing support can confirm the rule actually applied to this validation and identify the private backend rejection reason.

Current policy is not consistently documented

The current Artifact Signing quickstart lists supported countries and organization-validation fields but does not state a minimum incorporation age or three-year tax-history requirement. It requires current public records, the legal entity’s business identifier and address, a website belonging to it, and monitored email addresses on its owned domain. It also says Microsoft may request additional documents through an Action Required workflow.^1^
Current MSIX signing guidance, however, explicitly says organizations must have “a verifiable tax history of three or more years” to obtain Public Trust certificates through Artifact Signing.^2^
The August 2026 statement that Artifact Signing has “no minimum org age restrictions” is a Microsoft employee’s Q&A response, not a published product-policy document.^3^
Artifact Signing’s resource documentation says Public Trust identity values are validated under the Microsoft PKI Services Third-Party Certification Practice Statement (CPS).^4^

Consequently, the available material does not establish whether the live GA validator currently enforces three years for every U.S. Organization/Public request. The MSIX page is current Microsoft documentation explicitly stating that rule, but the Artifact Signing quickstart and employee response conflict with it. Microsoft must reconcile which policy applies to the validator.

Evidence a newly formed organization can provide

Artifact Signing’s public documentation does not publish an exhaustive list of acceptable legal documents. It expressly requests:

Exact legal organization name and registered business address
Business identifier
Entity-owned website
Up-to-date public records
Representative’s name exactly matching government-issued identification
Primary email on a domain owned by the legal entity
A different secondary email using that same domain^1^

If either submitted email used Gmail, Outlook.com, or another free/public domain—or a domain not owned by the LLC—have support check that first. A closely matching Artifact Signing case was resolved by using an email address associated with the entity rather than a free-hosted address.^5^ Do not resubmit merely to test this; ask whether the email-domain check caused the existing failure.

Do not assume that articles of organization, EIN records, D‑U‑N‑S data, or tax documents will independently override an age requirement. No Artifact Signing source provided here guarantees acceptance of any particular document set.

Private review and escalation

In the Azure portal, open the affected Artifact Signing account → Support + Troubleshooting. Alternatively, select ? → Create a support request.
Select the affected subscription and Artifact Signing service. Describe the issue as Organization/Public identity validation failed after Verified ID succeeded; portal exposes no rejection reason.
Include the validation ID, UTC submission/failure times, account/resource name, and representative email domain in the private ticket—not in Q&A.
Ask support to:
- Identify the exact failed validation control.
- Confirm whether three years of history was applied.
- Name the governing policy/CPS provision.
- Specify the exact corrective evidence accepted before resubmission.
- Route the case to the Artifact Signing identity-validation/product team.

Creating or managing the request requires subscription-level Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission.^6^

After the case exists, use Help + support → All support requests → case → New message for identifiers. Wait for the assigned engineer’s secure-document instructions before uploading legal or identity documents. Azure’s general attachment guidance supports case uploads but warns against including personal information; attachments are limited to five files of up to 5 MB each.^7^

The Artifact Signing FAQ directs identity-validation issues to Azure Support and explains that a non-email-related failure means the validation team could not make a determination from the supplied information.^8^

Opening the workflow is available, but Basic Artifact Signing SKU is not itself a technical-support entitlement. Azure documents free unlimited support for subscription-management matters; technical investigation requires an applicable support plan.^6^ No documented no-additional-cost path guarantees backend diagnosis or product-team routing for a Basic-support customer. Microsoft may choose to review or route the policy inconsistency, but that cannot be promised from the published support terms.

References