Artifact Signing: individual identity validation stuck at "Action Required" - Verified ID is in Authenticator but cannot be presented (QR loops)

Question

My Artifact Signing individual identity validation cannot complete. The AU10TIX Verified ID was issued into Microsoft Authenticator, but presenting it back to Artifact Signing never works, and the portal keeps the request at "Action Required".

IDs (in case a Microsoft engineer can look):

• Tenant ID: 82407442-4ed7-407f-bc68-cef0cdb88284
• Subscription ID: 50693703-e88b-4e88-bcdf-ab602c2a2f33
• Artifact Signing account: The3WCircus (resource group 3wcircus-signing, East US, Basic)
• Identity validation request ID: 29c6c31a-8ce7-4ab8-afb9-a53c4e23360a (Individual, Public Trust)
• Last failed attempt: 2026-09-20, about 14:43 UTC
• Azure support request (auto-closed, Basic plan has no technical support): 2609200040001297

What happens:

1. The AU10TIX step works. The "Government Issued ID - GLOBAL" credential shows up in Authenticator's Verified IDs tab.
2. On the verification page (credentials.microsoft.com) I get "Present your Verified ID" with a QR code, or just a spinner that says "Processing...".
3. Scanning the QR with the scanner in Authenticator's Verified IDs tab returns me to the app's home screen. I never see a Share prompt, and the web page stays on "Processing...".
4. Opening the verification link directly on the phone still offers only the QR code.

What I have tried:

• Fresh QR code every time (page reloaded)
• Edge (InPrivate) and Chrome
• Force-closing and reopening Authenticator
• Adding ******@gmail.com as a personal account in Authenticator
• No VPN or proxy, stable Wi-Fi
• The phone is a Samsung Galaxy S9+

The Verified ID and the request are untouched, so nothing has been deleted or recreated.

One thing that may matter: the Authenticator app on the phone is signed in as a different personal Microsoft account (hotmail.com) than the one that owns the Azure tenant, subscription and this request (******@gmail.com). The credential was issued into that app with ******@gmail.com typed in as the email at the AU10TIX step.

Questions:

1. Must the Verified ID live in a wallet belonging to the same Microsoft account as the identity validation request? If yes, how do I change or fix that without rebuilding the whole tenant?
2. Is there a known issue with the presentation step on older Android versions?
3. Can someone reset the presentation for this request, or does it need to be deleted and recreated? I would prefer not to recreate it.

Thanks.

Answer 1

Fair enough, and sorry it ended that way. You're right about the gap: individual validation has exactly one path, a Verified ID presented from Authenticator on a phone, with no desktop or document-based alternative. That's worth putting on record as product feedback through the feedback link at the bottom of the Artifact Signing docs, because you won't be the last person with a perfectly good older phone hitting this wall.

If the goal is simply to get your apps signed, two routes that don't involve a phone at all:

1. A standard OV code signing certificate from a public CA (DigiCert, Sectigo, GlobalSign, SSL.com). Their identity checks are document and phone/video based, the cert ships on a USB token or through their cloud signing service, and it works with SignTool as usual.
2. If you still want the Azure side, several of those CAs support Azure Key Vault Premium as the key store, and you sign with AzureSignTool in your pipeline. That's Azure without Artifact Signing's validation step.

Thanks for reporting back what didn't work, that genuinely helps the next person who lands here.

Answer 2

Hi @K Yancy

Direct answers to your three questions, then the fix.

1. No, the wallet doesn't need to match the account. Verified IDs live in Authenticator's wallet on the device itself, not under the signed-in Microsoft account. What matters is the email you typed at the AU10TIX step, and you used the gmail address that owns the request, so that part is fine. Don't rebuild anything.
2. Very likely, and this is my top suspect. The S9+ maxes out at Android 10, and older app/OS combos don't fully support the current Verified ID presentation flow. The exact symptom you describe (scan works, app drops to home screen, no Share prompt, page stuck on Processing) is what a failed presentation handoff looks like.
3. Nothing to reset. Every fresh QR is a brand new presentation request, and your identity validation just waits in Action Required until one succeeds. Don't delete or recreate it.

The fix, in order:

1. Quick checks on the S9+ first: update Authenticator from the Play Store, set date/time to automatic, switch to mobile data with Wi-Fi off, turn off Private DNS (Settings > Connections > More connection settings), then generate a fresh QR on the PC and scan it immediately from Verified IDs tab > QR icon, tapping Share when prompted.
2. If that still loops, borrow or use any newer phone (Android 12+ or an iPhone). Install Authenticator, open your verification link on the PC again, redo the AU10TIX step so the credential is issued into the new phone's wallet, then present from there. Since the wallet is device-bound, re-issuing is the only way to move it, and your request stays intact the whole time.
3. If you still want Microsoft to look, grab logs first: Authenticator > menu > Send feedback > Having trouble, with logs included. Then reopen a ticket as Billing/subscription management (free on Basic) and ask for routing to Artifact Signing identity validation, referencing your closed case 2609200040001297. And edit your tenant and subscription IDs out of the public post, share those only in the ticket or by private message.

If this helped, please click Accept Answer so others stuck at this step can find it.

References: https://learn.microsoft.com/en-us/answers/questions/5767304/identity-validation-stuck-on-action-required-authe https://learn.microsoft.com/en-us/azure/artifact-signing/quickstartHi @K Yancy,

Direct answers to your three questions, then the fix.

1. No, the wallet doesn't need to match the account. Verified IDs live in Authenticator's wallet on the device itself, not under the signed-in Microsoft account. What matters is the email you typed at the AU10TIX step, and you used the gmail address that owns the request, so that part is fine. Don't rebuild anything.
2. Very likely, and this is my top suspect. The S9+ maxes out at Android 10, and older app/OS combos don't fully support the current Verified ID presentation flow. The exact symptom you describe (scan works, app drops to home screen, no Share prompt, page stuck on Processing) is what a failed presentation handoff looks like.
3. Nothing to reset. Every fresh QR is a brand new presentation request, and your identity validation just waits in Action Required until one succeeds. Don't delete or recreate it.

The fix, in order:

1. Quick checks on the S9+ first: update Authenticator from the Play Store, set date/time to automatic, switch to mobile data with Wi-Fi off, turn off Private DNS (Settings > Connections > More connection settings), then generate a fresh QR on the PC and scan it immediately from Verified IDs tab > QR icon, tapping Share when prompted.
2. If that still loops, borrow or use any newer phone (Android 12+ or an iPhone). Install Authenticator, open your verification link on the PC again, redo the AU10TIX step so the credential is issued into the new phone's wallet, then present from there. Since the wallet is device-bound, re-issuing is the only way to move it, and your request stays intact the whole time.
3. If you still want Microsoft to look, grab logs first: Authenticator > menu > Send feedback > Having trouble, with logs included. Then reopen a ticket as Billing/subscription management (free on Basic) and ask for routing to Artifact Signing identity validation, referencing your closed case 2609200040001297. And edit your tenant and subscription IDs out of the public post, share those only in the ticket or by private message.

If this helped, please click Accept Answer so others stuck at this step can find it.

References:
https://learn.microsoft.com/en-us/answers/questions/5767304/identity-validation-stuck-on-action-required-authe
https://learn.microsoft.com/en-us/azure/artifact-signing/quickstart

Answer 3

None of this worked, and I'm not getting a new phone to sign my apps. Thank you for trying to help. I'm punting on the Azure approach. It shouldn't require a mobile device as the only option to complete the process after I verifiably submitted all the legal documentation and was confirmed, but no other options were provided besides getting a new phone.

Thanks for trying to help, though; I do appreciate it. This is a M$ lame implementation.