Verification of publisher domain failed. The json file located at https://<domain>/.well-known/microsoft-identity-association is too large. [ew/zl1zenz+fECi9geJkOk]

Question

Verification of publisher domain failed. The json file located at https://<domain>/.well-known/microsoft-identity-association is too large. [ew/zl1zenz+fECi9geJkOk]

Vishnuraj Rajagopal 0

Any resolution for this? The file is around 112 bytes. And returning the same application id.

{

"associatedApplications": [

{

  "applicationId": "<id>"

}

]

}
Content-Length: 112.

Content-Type: application/json; charset=utf-8

Vishnuraj Rajagopal 0 Reputation points

2026-10-30T11:07:40.0466667+00:00
Following the AI answer’s suggested checks, I ran both commands from outside the hosting environment on 30 October 2026 at 11:03:55–56 UTC:

curl -i --max-redirs 0 https://trecs.aero/.well-known/microsoft-identity-association.json curl -iL -A "Mozilla/5.0" https://trecs.aero/.well-known/microsoft-identity-association.json

Both returned:

HTTP/2 200 content-type: application/json; charset=utf-8 content-length: 112 cache-control: no-cache, no-store, must-revalidate server: Google Frontend

Both returned the same raw JSON:

{ "associatedApplications": [ { "applicationId": "1bb594d6-c57d-44b0-8813-117b28ff862e" } ] }

Neither request redirected or returned HTML, authentication pages, or bot challenges. The application ID matches the app registration.

These checks did not reproduce a response difference. What additional diagnostics can identify why Entra reports this 112-byte response as too large?

1 answer

Your answer

Vishnuraj Rajagopal 0 Reputation points

2026-10-30T11:07:40.0466667+00:00

Following the AI answer’s suggested checks, I ran both commands from outside the hosting environment on 30 October 2026 at 11:03:55–56 UTC:

curl -i --max-redirs 0 https://trecs.aero/.well-known/microsoft-identity-association.json curl -iL -A "Mozilla/5.0" https://trecs.aero/.well-known/microsoft-identity-association.json

Both returned:

HTTP/2 200 content-type: application/json; charset=utf-8 content-length: 112 cache-control: no-cache, no-store, must-revalidate server: Google Frontend

Both returned the same raw JSON:

{ "associatedApplications": [ { "applicationId": "1bb594d6-c57d-44b0-8813-117b28ff862e" } ] }

Neither request redirected or returned HTML, authentication pages, or bot challenges. The application ID matches the app registration.

These checks did not reproduce a response difference. What additional diagnostics can identify why Entra reports this 112-byte response as too large?

Answer 1

Your file looks correct from the public internet. I fetched it several ways on 2 November 2026: over HTTP/2, HTTP/1.1 and HTTP/1.0, with and without the .json extension (the error message shows the path without it), with a browser user agent, with no user agent, and with Accept-Encoding: gzip. Every time I got 200, application/json; charset=utf-8 and exactly 112 bytes, with no byte-order mark and no redirect. Plain http:// redirects to https:// with a 301, which is normal.

So the size of the file isn't the problem. The most likely explanation is that Entra's verification request gets a different response from the one you and I see, for example an HTML block, challenge or error page from something in front of your site. An HTML page would easily exceed the size Entra accepts, which would explain a "too large" error for a 112-byte file.

Your response comes from a Google Cloud load balancer (server: Google Frontend). Rules at that layer, such as Cloud Armor policies, bot management, geo restrictions or rate limits, can treat requests from Microsoft's servers differently from your tests.

How to confirm it

Step 1. In your Google Cloud load balancer request logs, find the request for /.well-known/microsoft-identity-association (with or without .json) at the exact time you click Verify and save domain. Check its status code, response size, source IP and user agent, and whether a Cloud Armor or security policy acted on it. If the logged response isn't your 112-byte JSON, that rule is the cause. Allow that path for all clients and try again.

Step 2. Test from Azure rather than from your own network. Open Azure Cloud Shell, which runs inside Azure, and run:

curl -s -o /dev/null -w "%{http_code} %{content_type} %{size_download}\n" https://trecs.aero/.well-known/microsoft-identity-association.json

If this returns anything other than 200 application/json; charset=utf-8 112, your edge is treating Azure traffic differently.

If the logs show Entra received the correct 112-byte JSON and verification still fails, open a support case with the correlation code from the error message.

A way around the file

If trecs.aero is (or can be) a verified custom domain in your Entra tenant, you don't need the JSON file at all. In App registrations > your app > Branding > Publisher domain > Update domain, choose Select a verified domain and pick it from the list. To add it, go to Entra ID > Domain names > Add custom domain and add the DNS TXT record that Entra gives you. A domain can be verified in only one tenant, so check that it isn't already verified in another tenant your organization owns.

If this helps you find the cause, please consider marking it as the accepted answer so others with the same error can find it.