Orphaned Artifact Signing identity validation

Artifact Signing resources and identity validations cannot be reassociated with a new tenant, so open an Azure Support case requesting service-side removal of the orphaned validation, then recreate the Artifact Signing resources in the current tenant.^1^

Open the cleanup request

1. In the Azure portal, go to Help + support → Create a support request.
2. Select the affected subscription and an Artifact Signing problem category. If offered, choose Submitting Validation Request, Validation Failed, or the closest identity-validation category.
3. State that:
   • The subscription was transferred to a new Microsoft Entra tenant.
   • The original tenant was deleted and cannot be accessed.
   • The existing identity validation remains linked to that former tenant.
   • Portal deletion is unavailable.
   • The orphaned validation prevents creation of a replacement.
4. Request that the Artifact Signing team:
   • Remove the orphaned identity-validation association server-side.
   • Clear any organization/subscription-level validation record that blocks a new request.
   • Confirm when a new identity validation can be submitted from the current tenant.
5. Include:
   • Current subscription ID.
   • Current tenant ID.
   • Former tenant ID, if available.
   • Artifact Signing account name, resource group, and region.
   • Identity-validation name/ID and current status.
   • Exact portal error and timestamp.
   • Correlation ID, if displayed.
   • Screenshot showing the disabled or failing deletion action.

Microsoft directs cases requiring another identity validation for the same organization to Support, and lists Azure Support as the assistance channel for identity-validation problems.^1^

Why portal deletion cannot resolve this case

The supported portal deletion procedure requires:

• The validation must not be in the In Progress state.
• The acting identity must have the Artifact Signing Identity Verifier role.
• The user must have read access at subscription scope or across all Artifact Signing accounts so linked certificate profiles can be evaluated.^2^

Those permissions are assigned to tenant identities, while identity validation is a prerequisite resource used by certificate profiles.^3^ Because the tenant that owns the existing association no longer exists, assigning current-tenant permissions does not provide access to the former tenant association. There is no documented CLI operation for this cleanup; identity-validation operations are portal-based.^2^

After Support clears the record

Artifact Signing does not support migration across tenants, subscriptions, resource groups, or resources. A tenant-ID change requires recreating all Artifact Signing resources.^1^

In the current tenant:

1. Assign the appropriate administrator the Artifact Signing Identity Verifier role.
2. Create a new Artifact Signing account if the transferred account cannot be used under the supported recreation requirement.
3. Submit a new identity validation.
4. After validation completes, create new certificate profiles and assign signer access.
5. Update any policy pinned to the previous certificate profile’s EKU. Recreating a certificate profile generates a new EKU, even when its name and identity are otherwise unchanged.^4^

Do not delete working certificate profiles or accounts before recording their configuration and assessing signing dependencies. Deletion stops certificate renewal and can halt signing, while deleted identity validations cannot be recovered.^2^

References

1. Artifact Signing FAQ
2. Renew or delete Artifact Signing Identity Validations
3. Artifact Signing resources and roles
4. Artifact Signing certificate management