Artifact Signing: organization identity validation failed twice with no reason given — is the 3-year business history requirement still enforced after GA?

I have an Artifact Signing account in the EU (Portugal) and two consecutive

Public organization identity validations have failed. The portal shows only

"Failed" with no reason, and I received no explanatory email.

Identity Validation IDs:

• 89a34d80-7a5f-439c-9310-9b1aa58e189d (failed, June 2026)
• 8abe51d4-e9dc-48cb-9696-89dbc48cbcc9 (failed, August 2026)

Context:

• Organization: a Portuguese "Unipessoal Lda", incorporated 28/12/2023, registered in the Portuguese Commercial Registry, with a NIPC business identifier
• Country/region: Portugal
• Identity type: Public
• Primary and secondary emails are both on the company-owned domain
• The email verification links were clicked within the validity window

I have two specific questions.

1. Can someone from the product team check the backend logs and tell me the

actual reason both validations failed? I can provide the Subscription ID and

Tenant ID privately.

2. Is the "3 years or more of verifiable history" eligibility criterion still

enforced now that the service is GA as Artifact Signing?

That criterion was announced in the "Trusted Signing Public Preview Update"

blog post of 1 April 2025, and Microsoft engineers still cite it in older Q&A

threads. However, it does not appear anywhere in the current documentation —

not in the quickstart (last updated 21/05/2026), not in the FAQ, and not in

the overview. Those pages list only geographic restrictions.

I ask because the geographic restriction from that same era ("organizations

based in the USA and Canada") has clearly been lifted, since the EU is now

listed as supported both in the docs and in the portal banner. If one

criterion from that announcement changed, the other may have changed too.

My company is 2 years and 8 months old. Whether this requirement still

applies determines whether it is even worth using my third and final attempt,

so a clear answer here matters more than a general pointer to the docs.

If the failures have a different, fixable cause instead — domain WHOIS

privacy, address verification, missing documentation, billing account name

mismatch — please tell me which one, so I can correct it before submitting

again. I am aware of the three-attempt limit and I do not want to waste the

last one.

Thank you.