Why does Microsoft want government issued photo ID to verify tenant ownership?

Question

Why does Microsoft want government issued photo ID to verify tenant ownership?

Alasdair Turnbull 86

Recently, authentication for three of my Entra IDs broke when MFA authentication requests from my tenants stopped arriving in my Authenticator app. Each case involved a sole Global Admin being locked out as a result. Instead of dealing with all three at once, MS requested I submit individual tickets for each ID/tenant. All of these issues were then sent to the Data Protection Team individually.

The first two cases were fixed within a week to ten days after the DPT reset MFA on the two Entra IDs as my credentials were otherwise correct. In the final case, the engineer escalated verification of ownership of the tenant. I don't know why as I'd already sent her the invoices for the services and tenant and can sign into all of my accounts, personal and Entra (with the exception of the MFA) as well as being able to supply the relevant passkeys.

Now the engineer wants a copy of my government issued photo ID to "verify the association between the tenant and its owner."

I fail to see how the requested ID accomplishes that.
Doesn't a copy of my invoice do that?
I also updated the DNS TXT record as requested - doesn't that prove ownership of the domain (which is now attached to the tenant)?
And I can log into all of my other MS accounts.

I don't like sharing ID for no particular reason. Shouldn't the above be enough?

Alasdair Turnbull 86 Reputation points

2026-02-24T20:44:23.3533333+00:00

Since the name on the tenant was "accepted" without verification, the ID doesn't establish ownership. Instead, whoever pays for the tenant has ownership.
VEMULA SRISAI 9,345 Reputation points Microsoft External Staff Moderator

2026-02-25T01:15:38.1+00:00

Alasdair Turnbull Thank you for taking the time to explain your concerns in detail — they’re completely understandable, especially given the sensitivity around personal identification.

In scenarios where a tenant has no accessible Global Administrator, Microsoft treats the recovery as a high‑risk, last‑resort access restoration. At this point, the goal is not only to confirm that the tenant and domain are legitimately owned, but also to positively identify the individual requesting full administrative control. This distinction is important.

The documents you’ve already provided — invoices, successful domain TXT verification, and access to related Microsoft accounts — do strongly support tenant and domain ownership. However, they don’t, by themselves, establish a high‑assurance link between the tenant and the person requesting the recovery. Because restoring Global Admin access is irreversible and effectively grants full control of the tenant, Microsoft applies additional identity verification to protect customers against accidental or malicious tenant takeover.

Requesting government‑issued photo ID is part of that identity‑verification step. It’s used strictly to confirm the requester’s identity and association with the tenant, and it’s handled through Microsoft’s secure support process. This measure exists precisely to prevent situations where billing records, DNS access, or email access may have been compromised or transferred without authorization.

That said, your privacy concerns are valid. You’re absolutely entitled to ask:

which specific fields must be visible,

whether non‑essential details can be redacted, and

how the document is securely stored and retained.

Once this final verification step is completed, the Data Protection team should be able to proceed with restoring access, just as they successfully did with your previous tenants.

We appreciate your patience throughout this process and understand the impact this has had.
Don Yu 0 Reputation points

2026-02-25T18:09:28.8166667+00:00

They don't care about security, they just want to send the personal information to third parties