Azure Artifact Signing identity validation fails after successful Face Check with HTTP 500

We are unable to complete an Artifact Signing organisation identity validation, even though the identity and biometric verification steps complete successfully.

The AU10TIX identity-verification process completes successfully. Microsoft Authenticator then performs Face Check and reports that the verification succeeded. The diagnostic data also records:

• FaceCheckStatus=success
• AppIntegrityStatus=success

However, after those successful checks, the Verified ID presentation fails when it is processed by Microsoft's service. The failure occurs in PostPresentationResponseOperation and returns HTTP 500 with the following error chain:

claimValidationError -> facecheckSessionFailure -> Unexpected session payload

This distinction is important: the identity verification, live face comparison, and app-integrity checks are succeeding. The failure occurs afterward, when the Artifact Signing / Entra Verified ID backend processes the successful presentation response. This therefore appears to be a technical service-side or integration failure rather than a failed identity or Face Check.

Diagnostic information for the failed transaction:

• Timestamp: 2026-08-18T00:46:31.521Z
• Request ID: 78c1da825ab79794354f828a6c2c1972
• Correlation Vector: LwsEQif1RAe26hb2KRfBPg.3
• Flow ID: C73AFFA5-1554-4990-87EC-BB0BB7409F26
• HTTP status: 500

Another unrelated Artifact Signing customer has reported what appears to be the same sequence: AU10TIX succeeds, Authenticator Face Check succeeds, and Microsoft's presentation endpoint then returns HTTP 500 with facecheckSessionFailure: Unexpected session payload:

Matching Microsoft Q&A report

Could the Artifact Signing or Entra Verified ID engineering team please trace the request and confirm whether this is a known backend issue? This is currently blocking completion of organisation validation and therefore prevents us from creating the required production signing certificate profile.

We can provide screenshots and any additional private account or validation identifiers through a secure support channel if required.