How to get Artifact Signing working with personal account

Antone Roundy 20 Reputation points
2026-05-22T22:37:06.65+00:00

My old code signing provider tripled their prices, so I'm trying to switch to Azure Artifact Signing. I followed the getting started instructions, got my identity validation completed, and followed the instructions for using signtool (which is what I used with my old provider.)

It looked like everything was ready to go, but when I tried to sign a file, when I tried to log in, I first got an error that I don't remember the exact wording of, but the gist of it was that my Microsoft account (which is a personal account) needed to be invited to be a guest in the organization (even though it was the same Microsoft account that I had used to set everything up.) So I sent myself an invitation. (Looking at the email, it's saying it's an invitation to join "Default Directory".) I clicked the "Accept Invitation" link in the email, and it sort of looked like it had worked.

So I tried signing the file again, and now I'm getting the following error:

"Selected user account does not exist in tenant 'Microsoft Services' and cannot access the application '04b07795-8ddb-461a-bbee-02f9e1bf7b46' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account."

I've searched and poked all around in the portal and can't seem to find any way to add my account as an external user to "Microsoft Services."

The only Microsoft account I have is the personal account I am using. Is it even possible to use Artifact Signing using this account? If so, can anyone tell me what my next step is?

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments
Answer accepted by question author
Jerald Felix 18,680 Reputation points Volunteer Moderator
2026-05-23T14:16:00.72+00:00

Hello Antone Roundy,

Greetings! Thanks for raising this question in Q&A forum.

The error you are seeing "Selected user account does not exist in tenant 'Microsoft Services'" is happening because Azure Artifact Signing (Trusted Signing) requires authentication against an Azure Active Directory (Entra ID) work or school account, not a personal Microsoft account (like outlook.com or hotmail.com). When you set up the resource in the Azure Portal using your personal account, Azure created an automatic "Default Directory" tenant behind the scenes — but the signtool signing client authenticates through a different Microsoft Services tenant (04b07795-8ddb-461a-bbee-02f9e1bf7b46), which your personal account cannot be added to as an external user. This is a known platform limitation, not a configuration mistake on your part.

Here are the steps to get this working correctly:

Step 1: Understand the core requirement

Azure Artifact Signing requires an Azure Entra ID (work/school) account for the signing client authentication flow. A personal Microsoft account alone cannot complete the interactive login that signtool initiates. This is by design and cannot be bypassed by sending yourself a guest invitation.

Step 2: Create a free Azure Entra ID tenant with a work account

The good news is you can create a free Entra ID tenant and a work-style account at no cost. Here is how:

Go to https://entra.microsoft.com → sign in with your personal Microsoft account → click Create a tenant → select Azure Active Directory → fill in your organization name (can be anything, like your name or app name) → complete the setup

This creates a proper Entra ID directory. Then create a user inside it:

Entra Portal → Users → New User → Create User → set a username like admin@<yourdomain>.onmicrosoft.com

Step 3: Move your Artifact Signing resource to the new tenant

Once your Entra ID tenant is ready, you have two options:

Option A — Re-create your Artifact Signing account under a subscription associated with the new Entra ID tenant. This is the cleanest approach since your identity validation is already completed and linked to your personal account identity.

Option B — Transfer your existing Azure subscription to the new Entra ID tenant. Go to:

Azure Portal → Subscriptions → Your Subscription → Change Directory → select your new Entra ID tenant

Note: This will temporarily break access to resources during the transfer, so plan accordingly.

Step 4: Assign the correct RBAC role to your new work account

After the resource is accessible from your new Entra ID tenant, assign your new work account the Artifact Signing Certificate Profile Signer role on the Trusted Signing Account resource:

Azure Portal → Your Trusted Signing Account → Access Control (IAM) → Add Role Assignment → search for Artifact Signing Certificate Profile Signer → assign it to your new Entra ID user account

Step 5: Update your signtool command to use the new account

When running signtool, make sure you are signed in with your new Entra ID work account (admin@<yourdomain>.onmicrosoft.com) rather than your personal Microsoft account. The interactive login prompt from signtool should now complete successfully since the account exists in the correct directory.

Step 6: If you want to stick with your personal account

Unfortunately, this is not currently supported for the interactive signing client flow. However, you can use a service principal with a client secret as a workaround for non-interactive/automated signing scenarios. This allows you to authenticate without an interactive Entra ID user login. The setup involves:

  • Creating an App Registration in your Entra ID tenant
  • Granting it the Artifact Signing Certificate Profile Signer role
  • Using the client ID and secret in your signing pipeline via environment variables:
AZURE_CLIENT_ID=<app-registration-client-id>
AZURE_CLIENT_SECRET=<your-client-secret>
AZURE_TENANT_ID=<your-tenant-id>

This is especially useful if you plan to automate signing in a CI/CD pipeline later.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.