Unable to verify publisher domain although verification file is publicly accessible

Question

Unable to verify publisher domain although verification file is publicly accessible

Maxim Hegel 0

Hello,

I’m having an issue verifying the publisher domain for my Microsoft Entra application.

Application name: auth-app Publisher domain: http.consulting

I created the required microsoft-identity-association.json file and placed it at the exact location specified by Microsoft:

https://http.consulting/.well-known/microsoft-identity-association.json

The file is publicly accessible in a browser and returns the expected JSON content, including the correct Application ID.

However, when I try to verify the domain in Branding & properties → Publisher domain, Microsoft returns the following error:

“Verification of publisher domain failed. Unable to connect to https://http.consulting/.well-known/microsoft-identity-association…”

I have attached a screenshot showing both the verification error and the same verification file successfully opening in the browser.

Could you please check why the Microsoft verification service is unable to access the file even though it is publicly reachable?

Please also let me know if there are any additional requirements regarding redirects, TLS/SSL configuration, HTTP headers, Cloudflare/CDN settings, or the Content-Type returned by the verification URL.

Thank you.

User's image

0 comments

1 answer

Your answer

Answer 1

Hello @Maxim Hegel

Since the file is publicly reachable in a browser, the next step is to verify the exact HTTP response that Microsoft Entra receives, not just whether the URL opens.

Microsoft’s documented requirements are that the file be hosted exactly at:

https://http.consulting/.well-known/microsoft-identity-association.json

and that the JSON contain the Application (client) ID of the app being verified.

I would test it with: curl -i https://http.consulting/.well-known/microsoft-identity-association.json

Check for: HTTP 200
No authentication/challenge
No redirect to another hostname/path
A supported Content-Type
The exact Application (client) ID in associatedApplications

Microsoft currently documents these supported content types:

application/json

application/json; charset=utf-8

and notes that an unsupported content type can cause verification to fail.

The JSON should look like:

{
  "associatedApplications": [
    {
      "applicationId": "<APPLICATION-CLIENT-ID>"
    }
  ]
}

Make sure this is the Application (client) ID, not the Object ID or service principal ID.

I would also temporarily bypass any Cloudflare/CDN/WAF behavior for the /.well-known/ path. Browser access can succeed while Microsoft’s verification service is blocked by bot protection, geo/IP filtering, TLS inspection, redirect rules, or other edge security controls. Similar Microsoft Q&A cases with the same “Unable to connect” message have required checking network filtering and, in some cases, Microsoft support because the issue was tenant/service-side.

If curl shows a clean 200, valid JSON, supported content type, no redirect, and the correct client ID, then I would stop changing the file itself. At that point, collect the exact verification timestamp/error reference and open a Microsoft Entra support case, because Microsoft may need to inspect why its verification service cannot reach or validate that endpoint.

Sharing you this reference:

Microsoft Learn – Configure an app’s publisher domain | https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-publisher-domain

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.