Artifact Signing
A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)
Artifact Signing org identity validation: Face Check fails with claimValidationError although Authenticator history shows the selfie matched
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 26%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKJ%3C/text%3E%3C/svg%3E)
Kim Jihoon
0
Reputation points
Product: Azure Artifact Signing (formerly Trusted Signing)
Account: randomgg-signing (East US), tenant 288da55e-cafe-41e9-bd86-5af712a8b258
Validation type: Organization / Public trust (RandomGG, Inc.)
Requester / primary email: the same signed-in account that created the request
What happens
- Identity validation request created in the portal; verification email received.
- Verified ID was issued successfully in Microsoft Authenticator via the AU10TIX flow (government ID + selfie).
- Opening the verification link and presenting the Verified ID with Face Check always ends with:
Error: Face Check failed
We could not verify your identity. Please confirm you are presenting your own Verified ID and return to Artifact Signing to try again.
Error Code: claimValidationError Missing permissions to fulfill this request. Failed Face Check Liveness check..
Key observation: in the Microsoft Authenticator Verified ID activity history, EVERY one of these failed attempts is recorded as "Your live selfie matched this ID's photo". So the wallet-side face match and presentation succeed — the failure seems to happen on the verifier/service side, and the "Missing permissions to fulfill this request" part looks like the real error.
Already tried (5+ attempts)
- Bright, even lighting; no glasses; phone at eye level; stable during liveness
- Recreated a brand-new identity validation request (the old email link then shows "no access")
- Opened the verification link in a fresh InPrivate window signed in ONLY as the requester account
- Confirmed Authenticator camera permission
Ask
Could someone from the Artifact Signing team check what "Missing permissions to fulfill this request" refers to on our validation requests and process the validation? I can share the exact validation request IDs, tenant/subscription IDs, timestamps and the requester email privately.
Artifact Signing
-
Kim Jihoon 0 Reputation points
2026-07-24T00:35:32.4866667+00:00 Gentle follow-up - this is still blocking us, as no code-signing certificate can be issued until the organization identity validation completes. Could someone from the Artifact Signing / Verified ID team take a look? Key point: Microsoft Authenticator's activity history records "Your live selfie matched this ID's photo" on every attempt, so the biometric match itself succeeds - yet the request still fails on the service side with "claimValidationError: Missing permissions to fulfill this request. Failed Face Check Liveness check." I'm happy to share the validation request IDs, tenant/subscription IDs, timestamps and requester email privately. Thank you!entle follow-up — this is still blocking us and no code-signing certificate can be issued until the organization identity validation completes. Could someone from the Artifact Signing / Verified ID team take a look? To reiterate the key point: the Microsoft Authenticator activity history records "Your live selfie matched this ID's photo" for every attempt, so the biometric match itself succeeds — the request still fails on the service side with "claimValidationError: Missing permissions to fulfill this request. Failed Face Check Liveness check." Happy to share the validation request IDs, tenant/subscription IDs, timestamps and requester email privately. Thank you!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 52%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
Meha-MSFT 2,125 Reputation points Microsoft Employee Moderator2026-07-24T02:23:45.0766667+00:00 we are looking into this. Meanwhile if this helps; https://learn.microsoft.com/en-us/entra/verified-id/using-facecheck#frequently-asked-questions-for-face-check-with-microsoft-entra-verified-id
-
Kim Jihoon 0 Reputation points
2026-07-24T02:55:43.4666667+00:00 Thanks Meha! One clarification that may help narrow it: our failure is the liveness leg, not the confidence threshold. The exact error is "Failed Face Check Liveness check" (not "Match confidence score failing to meet the threshold"), and Microsoft Authenticator's activity history shows "Your live selfie matched this ID's photo" on every attempt - so the face match itself succeeds. The device is a Samsung Galaxy with Developer Options enabled; Microsoft Authenticator was installed from the Google Play Store. Two questions: (1) Is this consistent with a Play Integrity / device-integrity rejection on the requester's device, and if so which signal fails (does enabling Developer Options or USB debugging drop MEETS_STRONG_INTEGRITY)? (2) We do not currently have a second device to test with - is there an alternative organization identity-validation path that does not require Face Check (e.g. a manual or document-based review)? Happy to share the validation request IDs and tenant/subscription IDs privately. Thank you!
-
Meha-MSFT 2,125 Reputation points Microsoft Employee Moderator
2026-07-24T18:10:20.28+00:00 this is the only path for identity validation, thanks for the details will pass it onto them.
-
Kim Jihoon 0 Reputation points
2026-07-27T09:31:47.2166667+00:00 Following up after a few days - has the Artifact Signing / Verified ID team come back with anything on the "Missing permissions to fulfill this request / Failed Face Check Liveness check" error? Since Face Check is the only validation path, we are fully blocked on issuing a code-signing certificate. Two things that might speed up triage: (a) we have several identity validation requests stuck in "In Progress" plus a few marked "Failed" on account randomgg-signing (East US) - happy to send the exact request IDs, tenant and subscription IDs privately; (b) if the root cause is device integrity (Play Integrity) on the requester's Android phone, just confirming that would let us borrow a clean device and retry rather than guessing. Any update appreciated - thank you!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 4%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDP%3C/text%3E%3C/svg%3E)
Daniel p 0 Reputation points2026-07-30T09:05:03.59+00:00 We are seeing what appears to be the same service-side failure on a Public organization identity validation in East US. AU10TIX issued the Government Issued ID Global credential successfully. On every attempt, Microsoft Authenticator completes Face Check and displays “Operation successful,” but credentials.microsoft.com remains indefinitely at “Processing…” and Azure remains “Action Required.” This has been reproduced more than 20 times across Brave and Safari, with no browser-side error shown. Please confirm whether this is part of the incident being investigated and whether the backend request can be reset or completed. We can provide the validation, tenant and subscription IDs privately.
-
Meha-MSFT 2,125 Reputation points Microsoft Employee Moderator
2026-07-30T17:02:25.81+00:00 @Kim Jihoon your VC is good, you will see status change to In Progress meaning other checks are being done now. The facecheck was lighting issue.
Sign in to comment
Sign in to answer