Unable to Verify Custom Domain in Azure App Registration Despite Correct DNS and Validation File

Question

I am trying to verify a custom domain for Publisher Verification in Azure App Registration, but the verification continues to fail even though all validation requirements appear to be correctly configured.

Domain: avistais.com

Validation File URL: https://avistais.com/.well-known/microsoft-identity-association.json

The file is publicly accessible and returns the following:

{
  "associatedApplications": [
    {
      "applicationId": "0d5471d1-50e2-426a-afdb-4b1f4c87a589"
    }
  ]
}

HTTP Response:

• Status: 200 OK
• Content-Type: application/json
• HTTPS enabled with valid SSL certificate

Response headers:

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0

Additional checks performed:

• The JSON file is accessible from browsers and curl.
• No AAAA (IPv6) records are configured for the domain.
• The hosting provider has confirmed the DNS records are correctly configured.
• The domain is verified in Microsoft Partner Center.

Despite this, Azure App Registration continues to fail domain verification.

Has anyone encountered a similar issue where the validation file is accessible and correctly configured, but Azure is still unable to verify the domain? Are there any backend validation logs, known issues, or additional checks that can be performed?

Any guidance would be appreciated. Cache-Control: no-store, no-cache, must-revalidate, max-age=0

Additional checks performed:

• The JSON file is accessible from browsers and curl.
• No AAAA (IPv6) records are configured for the domain.
• The hosting provider has confirmed the DNS records are correctly configured.
• The domain is verified in Microsoft Partner Center.
• Microsoft support has indicated that the issue may be related to Azure App Registration Publisher Verification / MPN domain validation and advised us to contact the appropriate Azure team.

Despite this, Azure App Registration continues to fail domain verification.

Has anyone encountered a similar issue where the validation file is accessible and correctly configured, but Azure is still unable to verify the domain? Are there any backend validation logs, known issues, or additional checks that can be performed?

Any guidance would be appreciated.

Answer 1

This is broken and we're all seeing it. Can someone at Microsoft please test this and FIX IT!

When we report problems MSFT PSS should reproduce them. Clearly that isn't happening:

Plus see how the error message omits the .json extension leading to even more uncertainty.

Not happy jan! This should be fully tested and not left up to customers to find broken!

Answer 2

hi Devesh Tiwari & thx for sharing urs issue here at Q&A portal,

If the file is public and looks correct, I’d check the exact app/domain relationship next.

For Publisher Verification, the applicationId in microsoft-identity-association.json has to match the Application/client ID of the app registration being verified, not the object ID and not another app in the tenant. Easy thing to miss.

The file should be reachable exactly here https://avistais.com/.well-known/microsoft-identity-association.json

& MS doc https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-publisher-domain

A few things that can still break validation even when browser/curl works

applicationId mismatch

redirect before the JSON is served

WAF/CDN blocking Microsoft validation user agent/IPs

wrong content-type or extra HTML wrapper from hosting

cert chain issue from Microsoft’s validator path

apex domain vs subdomain mismatch

stale publisher/domain state in Partner Center or Entra backend

I’d test with

curl -I https://avistais.com/.well-known/microsoft-identity-association.json

curl -L https://avistais.com/.well-known/microsoft-identity-association.json

Make sure there’s no 301/302 chain to another host, no auth/cookie challenge, no bot protection page, and the final body is raw JSON only. Since Partner Center already shows the domain verified, this may be a Publisher Verification backend sync issue between Partner Center/MPN and Entra app registration. Best move is open a Microsoft Entra ID / App registrations support case w/ tenant ID, app/client ID, publisher domain, Partner Center verification proof, the validation URL, and UTC timestamps of failed attempts. Ask them to check backend publisher-domain validation logs for that app. The portal doesn’t expose those logs, unfortunately.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/