Artifact Signing identity validation: email verification link fails with "access rights" error

Question

I'm setting up Azure "Artifact Signing" for an organization (Public Trust). I completed the

Face Check / Verified ID identity verification successfully. Following that, I received an

email verification link. Clicking it returns:

"The client does not have access rights to the content."

URL pattern: verifyemail.microsoft.com/v1.0/tokenverification/verify?token=...

This is a repeat issue. My original identity validation request failed for the same reason

(email verification failure). I submitted a new identity validation request and completed

Face Check again, but I'm hitting the same error on this new request's verification link.

Has anyone else resolved this, or does it require Microsoft support to manually clear?

Happy to share the Identity Validation ID and subscription details privately if that would help.

Answer 1

I clicked the verify email address link like 20 times this time and then about 10 minutes later it sent me that I was valid.

Answer 2

This usually does not require a manual backend clear first. The documented checks are:

1. Confirm the email account matches exactly between:
   • the Primary Email entered in the identity validation request, and
   • the account used to sign in when opening the verification link.
   For Artifact Signing identity validation, a mismatch can cause an access error when opening the validation page.
2. Check whether the verification link expired. The email verification link expires after seven days. If it expired, a new link cannot be resent for the same request. The fix is to delete the current identity validation request and submit a new one.
3. Check mail filtering conditions for the primary mailbox:
   • confirm the mailbox accepts messages from external senders
   • confirm messages containing links are not being filtered
   • ask the email administrator to verify that firewall, security, or email filtering policies are not blocking the message or altering the verification flow
4. If the request already moved to Failed because of email verification, the documented action is to create another identity validation request. Also ensure the email used is not a distribution list and can receive links from external email addresses.
5. For organization identity validation, if email verification failed because the link was missed or not completed within seven days, the required action is again to create a new identity validation request.
6. If the same problem continues after using the exact same sign-in email and a fresh request, use the supported escalation path for Artifact Signing identity validation:
   • create an Azure Support ticket, or
   • post on Microsoft Q&A with the artifact-signing tag.

A practical end-to-end path for this scenario is:

1. In the Azure portal, open the Artifact Signing account and review the identity validation request.
2. Verify the Primary Email on that request is the same account used to open the verification link.
3. If the link is older than seven days, stop using that request.
4. Delete the failed/in-progress request and create a new organization Public identity validation request.
5. Make sure the primary mailbox is a monitored mailbox on the organization-owned domain and can receive external emails with links.
6. Complete the verification again using that same email identity throughout.
7. If the access-rights error still occurs on the fresh request, open Azure Support for Artifact Signing.

Also note: creating more identity validation requests for the same entity while one is already in progress does not help, and requests cannot be expedited.

---

• Artifact Signing FAQ
• Artifact Signing FAQ
• Quickstart: Set up Artifact Signing
• Artifact Signing FAQ