Artifact Signing organization validation: verification link already used after failed face check

A failed Face Check during organization identity validation cannot be retried on the consumed link; the documented recovery is to delete the identity validation request, remove its associated Verified ID from Microsoft Authenticator, then create a new request and a new Verified ID.^1^

Required recovery

The FAQ explicitly states that this procedure applies to the individual verification step within organization identity validation:

1. Record the validation/request ID, Artifact Signing account name, current status, failure time, and screenshots for reference.
2. In the Azure portal, open the Artifact Signing account → Identity validations.
3. Delete the affected identity validation request.
4. In Microsoft Authenticator, remove the Verified ID associated with that validation attempt.
5. Return to Identity validations and create a new Public organization validation request.
6. Complete issuance of a new Verified ID and perform Face Check again.
7. For Face Check:
   • Use even, moderate lighting.
   • Avoid direct sunlight, backlighting, and deep shadows.
   • Center your unobstructed face and look toward the camera.
   • Clean the camera lens and remove sunglasses or anything obscuring your face.

Face Check compares the live capture with the photo in the presented credential. If the match does not meet the required threshold, the presentation fails.^2^

This means the existing Verified ID is not the supported retry path after this particular failure. Although Artifact Signing normally permits presenting an existing valid Verified ID, the more specific FAQ procedure for a Face Check error requires removing the associated credential and creating a new one.^1^

Preserving or resetting the existing request

No public self-service operation is documented to reset the consumed verification session or reissue its link while preserving this request. The FAQ also says that an expired email-validation link cannot be resent on the same request, although that is a different failure stage.

A closely matching report—Action Required followed by “this link has been used already”—was identified as a known issue at that time, but its accepted answer did not provide a reset procedure.^3^ Another stuck-validation case required intervention by the relevant team rather than a documented user-side repair.^4^

Therefore, preserving the request is possible only if Artifact Signing support chooses to repair its backend state; it is not a documented recovery option.

Escalation with a Basic support plan

Azure Basic provides subscription-management support, but a support plan is required for technical support.^5^ That explains why the portal prevents submission of this technical case.

The supported alternatives are:

• Continue through Microsoft Q&A using the Artifact Signing tag, as you have done. The Artifact Signing FAQ expressly lists Azure Support and Microsoft Q&A as the support channels for identity-validation assistance.^1^
• Have someone with an eligible Azure technical-support entitlement open the case. They must also have Owner, Contributor, or Support Request Contributor access at subscription scope.^5^
• Upgrade or link an eligible support plan under Azure portal → Help + Support → Support Plans, then submit the case against the affected subscription.

Include only non-sensitive diagnostic details publicly:

• Exact error text
• Validation type and status
• UTC date/time of the failed Face Check
• Artifact Signing region
• Whether Authenticator completed issuance before Face Check failed
• Authenticator incident ID, if available

Provide the subscription ID, tenant ID, validation ID, logs, and tokenized URL only through the private fields of an Azure support case. The FAQ recommends sending Microsoft Authenticator logs and an incident ID when escalating technical Verified ID errors.^1^

References

1. Artifact Signing FAQ
2. Use Face Check with Microsoft Entra Verified ID
3. Terrible Identity validation experience - Microsoft Q&A
4. Azure Artifact Signing identity validation stuck in Pending for 4 weeks — email verification link returns "The request is blocked - Microsoft Q&A
5. Create an Azure support request