Artifact Signing organization validation: “You need permission” and verification shows Microsoft Accounts tenant - question 2

Do not create a new identity on the assumption that it will inherit the existing Action Required validation; the documented path is to have Azure Support inspect or reset the existing request because Microsoft does not document post-creation identity substitution.

What the current error means

For the individual verification step—including the individual representative step within organization validation—the address used to access the verification link must match the primary email recorded in the request. A mismatch produces “You don't have permission to access this page.” ^1^

Your attempt used the exact text of the primary address, but Microsoft reported that no account exists for it. That establishes a different issue: the business mailbox is currently an email destination, but apparently is not recognized as a Microsoft sign-in identity.

The documentation does not establish either of these behaviors:

• that creating a Microsoft Entra work or school identity after submission attaches it to the existing request;
• that equality is determined solely from the visible email/UPN string rather than the identity associated with the original request.

Therefore, it cannot be confirmed that a newly created same-address Entra user will complete this particular request.

Request Microsoft review of the existing validation

Open Azure portal → Help + support → Create a support request and select the Artifact Signing/security category available for the subscription. Artifact Signing directs identity-validation issues to Azure Support or Microsoft Q&A; it also warns that creating additional requests while the same entity has one in progress does not help. ^1^

Include:

• Artifact Signing account and subscription
• Identity Validation ID
• Current status: Action Required
• Primary email address, with sensitive portions redacted from public posts
• Exact “You need permission” and “We couldn't find an account with that username” messages
• Screenshot showing the Microsoft Accounts tenant
• Confirmation that the mailbox works but is hosted outside Microsoft
• The Microsoft Entra tenant ID
• A request to confirm whether the validation is bound to a specific identity object or only to the primary-email string
• A request to reset/retrigger the existing verification if a newly created identity cannot use it

Do not publish the validation ID, tenant details, or unredacted screenshots in Q&A; provide them through the private support case.

If Support instructs you to create a same-address Entra identity

The address’s domain must first be added and verified in the existing Entra tenant. Microsoft Entra users sign in with their userPrincipalName (UPN), so the new user’s UPN would need to be the exact primary address. ^2^

1. In the Microsoft Entra admin center, switch to the existing directory.
2. Go to Entra ID → Domain names → Add custom domain.
3. Add the domain portion of the primary address.
4. Verify ownership using the DNS record supplied by Entra.
5. Prefer the offered TXT verification record and leave the existing mail-provider MX records unchanged. Entra supports domain verification through TXT or MX records. ^3^
6. After the domain is verified, create the member user with the exact address as its UPN.
7. Open the existing verification link in a private browser session and explicitly choose that work or school account.

Verifying the domain by TXT and creating an Entra user do not require moving the mailbox into Microsoft 365; mail continues to follow the domain’s existing MX records. However, only perform this as a recovery attempt after Support confirms that the existing validation can recognize the newly created identity.

If Support says the identity cannot be substituted, request that it reset the current validation or authorize a replacement request. Artifact Signing requires a new request when validation information must be changed, and the FAQ specifically directs customers to Support when another validation for the same organization is needed with a different primary address. ^4^

References

1. Artifact Signing FAQ
2. Plan and troubleshoot UserPrincipalName changes in Microsoft Entra ID
3. Add your custom domain name to your tenant
4. Quickstart: Set up Artifact Signing