Organization identity validation: "You need permission" — verification link signs into "Microsoft Accounts" tenant instead of enrollment tenant

Check the existing validation request’s Primary Email and access the verification link using that exact email identity—not merely the personal Microsoft account that owns the Azure subscription.

Check the identity tied to the request

For Organization validation, the Primary Email must be a monitored address on the organization-owned domain. During the individual verification step within Organization validation, Artifact Signing directs the representative to use the email supplied when the request was created.^1^

1. Open Azure portal → Artifact Signing account → Identity validations.
2. Open the existing request and identify its Primary Email.
3. Compare it with the complete sign-in name displayed in the “You need permission” message.
4. If the Primary Email is your Google Workspace company address, use that exact address at the Microsoft sign-in prompt.
   • It must be usable as the Microsoft sign-in identity for this flow.
   • Signing in with an unrelated personal Microsoft account—even if it owns the subscription and has the Artifact Signing role—does not satisfy the email-match requirement.
5. If the Google Workspace address cannot authenticate as the required Microsoft identity, proceed to Azure Support rather than creating another request.

Microsoft documents the same permission symptom for the individual identity-validation stage as an email mismatch between the request and the account used to open the link.^2^

Your existing role assignment is sufficient for managing identity validation: Artifact Signing Identity Verifier is the role that grants that capability; subscription Owner alone does not manage identity validation.^3^

If the exact Primary Email still receives the tenant error

Create an Azure support request:

1. In the Azure portal, open Help + support.
2. Select Create a support request.
3. Choose the service/category for Azure Artifact Signing and describe it as an Organization/Public Trust identity-validation sign-in tenant mismatch.
4. Include:
   • Identity-validation request ID
   • Subscription ID and tenant ID
   • Artifact Signing account name and region
   • Primary Email entered on the request
   • Sign-in identity shown by the error
   • Exact error text and timestamp
   • Screenshot with personal or sensitive values redacted
   • Confirmation that the exact Primary Email was used, if applicable
5. Ask support to inspect the existing request and determine whether it can be reset/re-triggered or whether a replacement request is required.

Artifact Signing’s official support path for identity-validation assistance is Azure Support or Microsoft Q&A. Q&A participants cannot inspect the private request or regenerate its link.^2^

Do not submit a duplicate while this request remains in progress; Microsoft states that additional in-progress requests for the same entity do not help. If support determines that the link has expired, the documented behavior is to create a new identity-validation request because a new link cannot be resent for the same request.^2^

References

1. Quickstart: Set up Artifact Signing
2. Artifact Signing FAQ
3. Artifact Signing resources and roles