Artifact Signing organization identity verification blocked by “You need permission”

Open an Azure Support case for the existing identity validation and ask Artifact Signing support to inspect or reset the request’s associated tenant and sign-in identity; this association cannot be inspected or corrected through Azure RBAC or Microsoft Q&A.

Submit the support request

1. In the Azure portal, open Help + support and create a support request.
2. Select the closest available routing for Azure → Security → Artifact Signing.
3. Use a title such as: Artifact Signing organization identity validation redirects to /verify/noPermission
4. Include:
   • Identity Validation ID.
   • Subscription ID and Microsoft Entra tenant ID.
   • Artifact Signing account name, resource group, Japan East region, and Basic tier.
   • Validation type: Public Organization.
   • Current state: Action Required.
   • The primary email address entered on the request.
   • The object ID and home tenant of the guest user attempting verification.
   • The exact redirect path: credentials.microsoft.com/verify/noPermission.
   • A screenshot showing Microsoft Accounts as the tenant, with sensitive values redacted.
   • Confirmation that both the emailed link and portal link produce the same result, including in Edge InPrivate.
   • Request for support to verify:
     1. which tenant and user identity are bound to the existing request;
     2. whether the request was associated with a personal Microsoft account rather than the guest identity;
     3. whether it can be reset or re-triggered without creating another organization request.

Microsoft’s Artifact Signing FAQ identifies Azure Support as the supported channel for identity-validation assistance. It also warns that additional requests for the same entity while one is in progress do not help.^1^ A comparable case involving an existing organization request associated with another contact likewise directs the customer to Azure Support so account information can be examined.^2^

Do not post the validation ID, tenant ID, subscription ID, email address, or screenshots containing tokens in the public Q&A thread.

Why another role assignment is unlikely to resolve this

The Artifact Signing Identity Verifier role authorizes management of identity-validation resources. Owner can manage the account and role assignments, but Owner alone does not grant the identity-validation capability.^3^ You already report that the required custom role is assigned and that the request itself is accessible in the portal, so repeating the IAM assignment is not the next useful action.

The verification link performs a separate identity check. Microsoft documents “You don't have permission to access this page” as occurring when the email on the validation request differs from the account used to open the link.^1^ Because you have already confirmed that the visible email values match, support needs to inspect the underlying account type, tenant, and request association rather than merely compare the displayed addresses.

Avoid replacing the existing request unless directed

Do not create another validation while this one remains active. If support determines that the request was created with the wrong primary identity or must be changed, a new validation request may be required; Microsoft documents that changes after creation require a new request.^4^ A reported Action Required case also records that a new request was required when the existing validation could not be changed.^5^

If deletion becomes necessary, note that deletion can affect linked certificate-profile renewal and deleted validations cannot be recovered. Confirm the impact with support before deleting anything.^6^

References

1. Artifact Signing FAQ
2. Identity validation request failed. - Microsoft Q&A
3. Artifact Signing resources and roles
4. Quickstart: Set up Artifact Signing
5. How to delete identity validation with "Action Required" status - Microsoft Q&A
6. Renew or delete Artifact Signing Identity Validations