Artifact Signing organization validation: “You need permission” and verification shows Microsoft Accounts tenant - question 3

Do not create a duplicate request while the existing organization validation is in progress; ask Azure Support to determine whether the work identity can continue that request or whether Microsoft must direct you to replace it.

Matching the business email text alone is not documented as sufficient when the existing request presents a Microsoft-account tenant but the new sign-in is a separate Microsoft Entra work identity. The documented “email addresses must match” resolution applies specifically to Individual identity validation, not organization validation.^1^

Check the work account’s resource access

1. Sign in to the Azure portal with the work account and select the Microsoft Entra tenant and subscription containing the Artifact Signing account.
2. Open Artifact Signing Accounts → your account → Objects → Identity validations.
3. Confirm that the existing validation is visible.
4. Confirm that the work identity has the Artifact Signing Identity Verifier role. This role—not Owner or Contributor—is required to create or manage identity validations.^2^
5. If the request provides a verification action, try it while signed in with that work identity.

Visibility and role assignment establish that the work account can manage the Azure identity-validation resource; they do not guarantee that the external verification system will treat it as the identity associated with the original request.

If “You need permission” remains

Open an Azure support request for Artifact Signing identity validation and provide the following privately:

• Artifact Signing account and identity-validation resource details
• Subscription and tenant IDs
• Current request status
• Correlation or transaction ID from the error
• Primary email entered in the request
• A note that the original flow identifies a Microsoft Accounts tenant while the proposed account is a Microsoft Entra work identity with the same email text

Ask support to determine specifically whether:

1. The existing request can be continued with that work identity.
2. The existing request needs to be reset.
3. You must delete it and submit a replacement.

Microsoft documents Azure Support as the assistance path for identity-validation issues. It also specifically directs customers to support when an identity validation already exists and another request is needed for the same organization with a different primary email.^1^

Do not create additional requests while this one remains in progress: Microsoft states that duplicates for the same entity do not help. If support instructs you to delete it, deletion requires the Artifact Signing Identity Verifier role.^3^

If the actual issue is an expired email-verification link rather than the account/tenant permission error, the documented action is different: links expire after seven days and cannot be resent for the same request, so a new validation request is required.^1^

References

1. Artifact Signing FAQ
2. Artifact Signing resources and roles
3. Renew or delete Artifact Signing Identity Validations