Azure Trusted Signing Identity Validation Not Working

Question

Created a new Trusted Signing Account and proceeded to complete Organization Validation.

Submitted the Validation request and received an email with the subject: "Action required: Complete your Trusted Signing identity validation".

Follow the 'Complete Identity Validation' link in the email. It asks to present my Verified ID. I do so via my Authenticator App but I keep receiving an error 'Verifiable Credential: You'll have to add this Verified ID and try again.'

Can't find anything on how to resolve this issue.

Answer 1

Firstly want to highlight that Microsoft Support that contacted me via private message was completely unhelpful. I managed to discover what the issue is after reading through the documentation in detail. I told Microsoft Support what needed to be done to fix it, and they cannot help me.

When you create a Organization Validation Request, make sure to use a User Account with a Entra Verified ID in the Primary Email Field. In our case, I made the mistake of using a shared mailbox, which cannot have a Verified ID assigned to it. This means that once you receive your email to complete the Validation Request, you are unable to authenticate the email link. Once a Validation Request is in progress, it cannot be edited to change the Primary Email address property. The Validation Request can also not be deleted or removed in any way.

To make matters worse, Validation Requests are linked to your Azure subscription, not the Trusted Signing Account. If your Validation Request is stuck, deleting the entire Trusted Signing Account and creating it again does nothing. The pending Validation Request will still be there.

Once you are in this situation, the validation request is effectively bricked. Been waiting 2 weeks now with no response or resolution from Microsoft Support.

Be very careful about what you enter into every single field of the Validation request.

Answer 2

I found the solution to this: you need to first establish a "Verified ID" in the Authenticator app. That is presumably the "card missing" that the error message is referring to.

To establish a Verified ID, follow the link under the Azure verification QR code that says "Don't have a Verified ID? Get verified here through our trusted ID-verifiers."

Here in the US, that link took me to a URL at a site called au10tix.com. From there, it took maybe 5 minutes to complete that process, including scanning in some government ID and taking a selfie.

Once done, it presented its own QR code, which the MS Authenticator app scanned to create a "Verified ID" in its wallet. Then I could double back to the QR code for Azure's identity validation, and it accepted it this time.

Answer 3

If you are still interested in using Artifact Signing. You can delete the existing identity validation request that's in progress and create a new request with the updated information.