Organization Identity Validation Failed I Individual Validation Done but Not Present

Microsoft Artifact Signing public identity validation follows strict PKI and CA/Browser Forum requirements and is intentionally conservative. The behavior described matches the documented process and limitations.

Key points from the documentation that apply to this case:

1. Public identity validation is governed by strict rules

• Public Trust identity validations must comply with the Microsoft PKI Services Third-Party Certification Practice Statement (CPS) and CA/Browser Forum requirements.
• All identity values (organization name, address, domain, etc.) must be validated against public records and must align consistently.
• If the information provided in the request (for example, principal address or organization details) doesn’t match what Microsoft can validate from public and supporting records, the request can’t be approved.

2. Why a rejection can stand even with multiple documents

• The documentation explicitly states that if Microsoft can’t validate the information, onboarding can’t proceed, even if additional documentation is provided:
  • “If identity validation fails, but not because of a missed email verification, the Microsoft validation team wasn't able to make a determination about your request based on the information that you provided. Even if you provide more documentations when we request it, if we can't validate the information, we can't onboard you to Artifact Signing.”
• It also states that if all three documentation attempts are exhausted, the process stops and can’t be continued for that request:
  • “In cases where extra documents were required, you have exhausted all three attempts. Therefore, we can't proceed further with the onboarding.”
• This is a process rule: once the system and validation team conclude they cannot establish the required level of assurance, the request is closed, even if the applicant believes the documents are sufficient.

3. Effect of a failed organization identity validation

• When organization identity validation fails and can’t be resolved, the guidance is to stop using that Artifact Signing account:
  • “Even if you provide more documentations when we request it, if we can't validate the information, we can't onboard you to Artifact Signing. In this scenario, we recommend that you delete your Artifact Signing account so that you aren't billed for unused resources.”
• Public Trust certificates cannot be issued without a successfully completed identity validation. Without that, certificate profiles that depend on that validation cannot be used for signing.

4. Individual identity validation vs. organization validation

• Individual identity validation is a separate flow, with its own requirements and verification path (using a billing account and a third‑party ID verifier like AU10TIX). Completing an individual validation does not substitute for or override a failed organization validation.
• Public Trust identity validation for organizations and individuals are distinct resources; a failed organization validation cannot be “fixed” by an individual validation.

5. What options remain Within the documented guidance, the supported options after a final failure are:

• Delete the existing Artifact Signing account to avoid charges if it cannot be used.
• If Artifact Signing cannot be used due to identity validation issues or regional/eligibility constraints, use a traditional Organization Validated (OV) certificate from a commercial CA instead. The documentation explicitly calls this out as the alternative when Azure Artifact Signing cannot be used:
  • OV certificates from CAs such as DigiCert, Sectigo, or GlobalSign are the recommended option when Azure Artifact Signing is not available or not usable.

There is no documented mechanism to override a final failed organization identity validation for Artifact Signing once all three documentation attempts are exhausted and the validation team has concluded that the organization does not meet the requirements.

References:

• Artifact Signing FAQ
• Quickstart: Set up Artifact Signing
• Artifact Signing resources and roles
• Code signing options for Windows app developers