Artifact Signing organization validation blocked by AADSTS50020; new MSA guest invitation resolves to existing administrator

Remove Account B’s email from Account A’s otherMails collection without changing A’s object, identities, UPN, roles, or redemption state; then verify that no directory object still matches B’s address and issue a new invitation.

1. Remove only the conflicting otherMails value

Microsoft Entra checks several properties when determining whether an invited address already exists, including userPrincipalName, mail, proxyAddresses, signInNames, and otherMails.^1^ Because B’s address is explicitly present in A’s otherMails, it can cause the invitation to resolve to A.

A derived UPN such as name_domain.com#EXT#@tenant.onmicrosoft.com is not itself equal to [Email]; inspect the actual stored values rather than treating the readable prefix as an exact match.

Connect to Microsoft Graph as Account A, read the existing values, remove only B’s address, and retain every other entry:

Connect-MgGraph -Scopes "User.ReadWrite.All"

$a = Get-MgUser -UserId "<Account-A-object-id>" `
    -Property Id,UserPrincipalName,Mail,OtherMails,ProxyAddresses,Identities

$bEmail = "[Email]"
$newOtherMails = @($a.OtherMails | Where-Object {
    $_ -ine $bEmail
})

Update-MgUser -UserId $a.Id -OtherMails $newOtherMails

This is a contact-attribute update, not a redemption reset. Before applying it, record A’s current object ID, UPN, identities, and otherMails. Do not modify A’s identities, delete A, or remove A’s administrator roles.

If B’s address is also present in proxyAddresses, Microsoft’s B2B troubleshooting guidance says that conflicting value must be removed through Microsoft Graph before reinviting.^2^

2. Confirm that the address no longer resolves to an existing object

Query the documented invitation-matching properties:

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '[Email]' or mail eq '[Email]' or proxyAddresses/any(x:x eq 'SMTP:[Email]') or signInNames/any(x:x eq '[Email]') or otherMails/any(x:x eq '[Email]')

Also inspect Microsoft 365 admin center → Users → Contacts and Teams & groups → Active teams & groups for the same address. Microsoft documents that users, groups, and contacts can hold conflicting addresses.^2^

Proceed only when:

• The query returns no object for B’s exact address.
• A still has the same object ID, authentication identity, accepted state, and administrator access.
• No contact or group retains B’s address.

3. Invite B again and verify that it is independent

Use Microsoft Entra admin center → Entra ID → Users → New user → Invite external user and invite B.

A new invitation should create a distinct user entity with userType set to Guest; the invitation must then be redeemed before B can access resources.^3^ Before redemption, the new object should show Pending acceptance. After B redeems using the intended MSA, its identity provider should show Microsoft account.^4^ MSAs are supported for B2B collaboration without additional identity-provider configuration.^5^

Confirm that B has:

• A different object ID from A.
• Invitation state: Pending acceptance, then Accepted after redemption.
• An identity of Microsoft account.
• No directory roles inherited from A.

Use the invitation email for redemption. If subsequently using My Apps, use the tenant-specific form documented for direct-link redemption so authentication occurs in the resource tenant.^6^

4. Assign the required Artifact Signing access

After B’s independent object is redeemed:

1. At the subscription scope, assign B Reader.
2. Open the Artifact Signing account → Access Control (IAM) → Add role assignment.
3. Assign Artifact Signing Identity Verifier to B at the Artifact Signing account scope.

The Identity Verifier must already have at least Reader at subscription scope, and identity validation management is portal-only.^7^

Do not reset A’s redemption status

Reset redemption preserves the same guest object and rebinds its sign-in information; it does not create B’s separate object.^8^ In this sole-administrator configuration, it could change how A signs in and should not be used for this objective.

Escalation paths

• Microsoft Entra support: Use this if Graph refuses the attribute update, another non-editable match remains, the new invitation still returns A’s object ID, or A’s binding cannot be preserved safely. Include both object IDs, actual matching properties, invitation response object ID, and AADSTS50020 trace/correlation data.
• Artifact Signing support: Treat this separately from the directory collision. If B can enter the tenant independently but the existing request still opens under Microsoft Accounts or shows You need permission, ask Artifact Signing support to investigate the existing validation request’s tenant and representative association. Microsoft directs customers to support when onboarding for the same organization requires a different primary email; whether backend remapping or a replacement request is necessary must be determined by that team.^9^

References

1. Microsoft Entra B2B collaboration API and customization
2. Troubleshoot common issues with Microsoft Entra B2B collaboration
3. Create invitation
4. Understand and manage the properties of B2B guest users
5. Use Microsoft accounts (MSA) for B2B collaboration
6. B2B collaboration invitation redemption
7. Tutorial: Assign roles in Artifact Signing
8. Reset the redemption status for a guest user in Microsoft Entra External ID
9. Artifact Signing FAQ