Artifact Signing representative verification: "You need permission" despite matching email

Open an Azure support request against the affected subscription and ask for escalation to the Artifact Signing identity-validation team without deleting or duplicating the existing in-progress request.

The documented cause of “You don't have permission to access this page” is a mismatch between the email in the individual identity-validation request and the account used to open the link. Since those addresses already match, that documented check is exhausted and the remaining issue requires account-specific investigation.^1^

Create the private support case

1. In the Azure portal, open the affected Artifact Signing account.
2. From its resource menu, select Support + Troubleshooting.
3. Complete the prompts and select Create a support request.
4. Select the subscription containing the Artifact Signing resource and choose the closest available Artifact Signing technical service/problem classification. Selecting the affected subscription is important because the assigned engineer receives access only to resources in that subscription.^2^
5. Use a summary such as:

   Artifact Signing Public organization validation – representative link returns “You need permission” although sign-in email matches

6. In Problem details, request:
   • Preservation of the existing identity-validation request.
   • Investigation of the representative/individual-validation access state.
   • Escalation to the Artifact Signing identity-validation or vetting team.
   • Confirmation before any reset, deletion, or replacement request is performed.

Microsoft documents Azure Support and Microsoft Q&A as the support options for Artifact Signing identity validation. It also states that creating more requests for the same entity while one is in progress does not help.^1^

Information to provide privately

Do not post request, subscription, tenant, or account identifiers in this public Q&A thread. In the support case, provide:

• Subscription ID and resource group.
• Artifact Signing account name and region.
• Existing identity-validation request ID.
• Validation type: Organization / Public Trust.
• Current status and the last status-change time.
• UTC timestamp of the latest failed attempt.
• Exact error text and screenshot.
• Representative email domain and confirmation that the signed-in Microsoft account uses the exact primary email. Avoid placing the full address in the public description.
• The original verification email, including its received date, but do not forward or publish the verification URL publicly.
• Browser/network trace if requested.

The initial support form permits one uploaded file, such as a browser trace or compressed diagnostic bundle. After the case is created, open Help + support → All support requests → the case → Upload file; up to five files can be attached. Remove unnecessary personal information before uploading.^3^

Permissions and preservation constraints

Creating a subscription-scoped support request requires Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission at subscription scope.^2^

Do not delete the request while seeking recovery:

• Official deletion guidance says an identity validation in In Progress cannot be deleted through the documented process.
• Deleted identity validations cannot be recovered.^4^

If the original link is more than seven days old, include that fact in the case. Verification links expire after seven days and cannot be resent on the same request; the general remedy is a new request.^1^ Because the stated goal is to preserve an existing organization request and the error persists despite an exact email match, obtain support’s decision before replacing it.

References

1. Artifact Signing FAQ
2. Create an Azure support request
3. Manage an Azure support request
4. Renew or delete Artifact Signing Identity Validations