Artifact Signing organization verification fails with AADSTS500202 for an external Microsoft account

Fablekick 0 Reputation points
2026-10-12T15:29:08.7633333+00:00

Our existing Artifact Signing organization identity validation is in Action Required. The invited Entra user is an external B2B Member and authenticates through a personal Microsoft account. The primary email on the validation matches the email used to sign in.

Opening the verification link from the existing Azure validation leads to credentials.microsoft.com. It first reports that the signed-in account is using Microsoft's personal-account tenant and does not have permission for the application's resource tenant.

I then used Sign-in options, Sign in to an organisation, entered the resource directory's onmicrosoft.com domain, selected the same existing account and completed the emailed sign-in code. The callback remains on Redirecting to Login page and logs invalid_grant / AADSTS500202, stating that the client or resource application does not support direct personal Microsoft accounts and suggesting an organizations or tenanted endpoint.

What is the supported way for this existing external B2B Member to complete the organization validation in the resource tenant? Is a correction to the verification application's authentication routing needed, or is there a supported correction to the existing validation? I would like to preserve the existing request and account rather than submit a duplicate validation or convert the existing user without guidance.

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.