A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)
Artifact Signing organization verification fails with AADSTS500202 for an external Microsoft account
Our existing Artifact Signing organization identity validation is in Action Required. The invited Entra user is an external B2B Member and authenticates through a personal Microsoft account. The primary email on the validation matches the email used to sign in.
Opening the verification link from the existing Azure validation leads to credentials.microsoft.com. It first reports that the signed-in account is using Microsoft's personal-account tenant and does not have permission for the application's resource tenant.
I then used Sign-in options, Sign in to an organisation, entered the resource directory's onmicrosoft.com domain, selected the same existing account and completed the emailed sign-in code. The callback remains on Redirecting to Login page and logs invalid_grant / AADSTS500202, stating that the client or resource application does not support direct personal Microsoft accounts and suggesting an organizations or tenanted endpoint.
What is the supported way for this existing external B2B Member to complete the organization validation in the resource tenant? Is a correction to the verification application's authentication routing needed, or is there a supported correction to the existing validation? I would like to preserve the existing request and account rather than submit a duplicate validation or convert the existing user without guidance.