Artifact Signing – Organization identity validation failed and primary email change required

Contact Artifact Signing support to clear or continue the existing organization validation before submitting another request with the administrator’s address as primary; Microsoft’s FAQ specifically requires support when an identity validation already exists for the organization under a different primary email.^1^

Recommended steps

1. Keep the existing Artifact Signing account.
   Do not delete it merely to exchange the email addresses. The account is the container for identity validations and certificate profiles, while identity validation is a separate resource.^2^
2. Request a backend review and primary-email reset.
   In the Azure portal, select Help + support → Create a support request. Include:
   • Artifact Signing account name, subscription, resource group, and region.
   • Failed Identity Validation ID.
   • UTC date and time of the failed attempt.
   • Current status: Failed.
   • Current primary and secondary email domains, but avoid posting complete addresses publicly.
   • Requested change: use the Azure administrator’s corporate mailbox as primary and the former primary mailbox as secondary.
   • Confirmation that both mailboxes accept external messages containing links.
   • Any AU10TIX correlation or transaction reference.
   • Microsoft Authenticator incident ID, if available.
   Similar unexplained Artifact Signing failures have required the support team to inspect the Identity Validation ID and account details in the backend.^3^
3. Do not create repeated requests while support is reviewing the organization.
   Microsoft states that duplicate requests for the same entity do not help. Because the intended retry changes the primary email, support must continue the onboarding process rather than having you independently create another validation.^1^
4. After support clears or authorizes the retry, open: Artifact Signing account → Objects → Identity validations → Organization → New Identity → Public. Enter:
   • Primary email: the administrator’s monitored mailbox on the organization-owned domain.
   • Secondary email: a different mailbox whose domain matches the primary email’s domain.
   • Exact legal organization information and the representative’s first and last names exactly as shown on their government-issued ID.
   Verification credentials and links go to the primary mailbox and expire after seven days. The mailbox must accept links from external senders.^4^

Answers to the specific questions

• How can the exact failure reason be determined?
  A portal status of Failed does not expose enough information to identify the cause. Request backend investigation using the Identity Validation ID and associated timestamps. Do not assume the primary-email ordering caused the failure unless support confirms it. A matching Q&A case with only a generic failure was resolved after escalation to the internal team.^3^
• Can a new request use a different primary email?
  Yes, but when an identity validation already exists with another primary email, Microsoft instructs customers to contact support to continue onboarding.^1^
• Can the existing Artifact Signing account remain?
  Yes. Nothing in the retry procedure requires recreating the account. Account deletion is recommended only if Microsoft ultimately cannot validate the organization and onboarding cannot proceed, to avoid charges for unused resources.^1^
• Must the Verified ID be revoked or recreated?
  Not solely because the organization request shows Failed. An existing, valid, unexpired Verified ID can be presented again. Remove it and create a new one only if the prior attempt reported Face Check, first/last-name mismatch, or address-mismatch errors; those conditions require deleting the associated validation request and Verified ID before retrying.^1^ If Authenticator produced a technical error, open Microsoft Authenticator → Send feedback → Having trouble? → Send, then retain the resulting incident ID for support.^5^

If no paid Azure technical support plan is available

Technical Azure support normally requires a support plan.^6^ If the portal will not permit this ticket:

1. Continue with Microsoft Q&A using the Artifact Signing tag; this is an official support option listed in the Artifact Signing FAQ.^1^
2. State that backend review is required for a failed Organization/Public validation and a primary-email change.
3. Provide no validation IDs, email addresses, tenant IDs, or other identifiers publicly. Ask Microsoft staff or a moderator for a private method to collect the Identity Validation ID and account details.

References

1. Artifact Signing FAQ
2. Artifact Signing resources and roles
3. Artifact Signing ID validation fails repeatedly 9afac007-6e27-4e93-84b1-34ac87fcdc90 - Microsoft Q&A
4. Quickstart: Set up Artifact Signing
5. Send Microsoft Authenticator logs and get an incident ID
6. Create an Azure support request for an Enterprise Agreement issue