I receive the "Selected user account does not exist in tenant 'Microsoft Services'" error, when trying to sign an exe on my pc

Question

I receive the "Selected user account does not exist in tenant 'Microsoft Services'" error, when trying to sign an exe on my pc

raelb 0

I am trying to sign a local exe file with Azure Trusted Signing. I have a simple Azure account, i.e. a single user and I am not part of any organizations etc. If I look in the "Default Directory" (in Azure), it shows only 1 user, and that's me.

So now to perform the exe code signing, I have gone through the required steps mentioned in https://learn.microsoft.com/en-us/azure/trusted-signing/how-to-signing-integrations

i.e., I've setup Identity Validation, Certificate Profile, installed the Trusted Signing Client Tools, assigned the required permissions for myself in Azure, created the metadata.json file.

At the command prompt I enter the required command, this starts the Trusted Signing process, and then brings up a tab in my browser to pick an Account. I click on my account, and then this error comes up:

"Selected user account does not exist in tenant 'Microsoft Services' and cannot access the application '04b07795-....-02f9e1bf7b46' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account."

Where do I find "Microsoft Services" tenant? And how to add myself as a user there?

(I'm on Windows 10 x64)

Raja Pothuraju 23,630 Reputation points Microsoft External Staff Moderator

2025-03-05T19:26:31.55+00:00
Hello @raelb,

Thank you for posting your query on Microsoft Q&A.

Based on your error I will recommend following the below steps to check if that works.

Try creating an additional tenant account through Entra Admin Center > Users > New User as a 'Member' with its own e-mail address as the 'Identity', then also create an app in Azure > Search > 'app registrations' > New Registration.

The latter provided a client ID, tenant ID, and 'secret' value necessary to complete the steps for authorization that Sign Tool would accept.

From there, three environment variables needed to be created within Windows (search > advanced system settings > Environment Variables).

The three value names are AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET and then each respective value needs to be assigned under each name.

a reboot is required to apply the new environment variables and with all of the other pieces in place as needed (certificate, signing profile, prerequisites, dlib, etc, etc, etc), SignTool could then code sign.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

raelb 0

@Raja Pothuraju Thanks for the suggestion.

What I found was that after signing up for a support plan, the code signing started working, without me doing anything else. So that makes me think that the issue was related to not having an active subscription (besides code signing). I also noticed that previously it said "(Guest)" next to my name, now that is gone.

I did follow your suggestion of creating an app, and then setting the Windows env variables as you suggested and then restart computer. However, then the code signing did not work and came up with this error:

[Label: Error after registered an App]
Submitting digest for signing...
Unhandled managed exception
Azure.RequestFailedException: Service request failed.
Status: 403 (Forbidden)

Headers:
Date: Thu, 06 Mar 2025 14:43:31 GMT
Connection: keep-alive
Strict-Transport-Security: REDACTED
x-azure-ref: REDACTED
X-Cache: REDACTED
Content-Length: 0
   at Azure.CodeSigning.CertificateProfileRestClient.SignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.CertificateProfileClient.StartSignAsync(String codeSigningAccountName, String certificateProfileName, SignRequest body, String xCorrelationId, String clientVersion, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.SignAsync(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle, CancellationToken cancellationToken)
   at Azure.CodeSigning.Dlib.Core.DigestSigner.Sign(UInt32 algorithm, Byte[] digest, SafeFileHandle safeFileHandle)
   at AuthenticodeDigestSignExWithFileHandleManaged(_CRYPTOAPI_BLOB* pMetadataBlob, UInt32 digestAlgId, Byte* pbToBeSignedDigest, UInt32 cbToBeSignedDigest, Void* hFile, _CRYPTOAPI_BLOB* pSignedDigest, _CERT_CONTEXT** ppSignerCert, Void* hCertChainStore)

SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147467259/0x80004005)

I then tried to delete the app, and remove env variables, and see if code signing was still working, but then I received this error:

[Label: After deleted app]
Unhandled managed exception
Azure.Identity.AuthenticationFailedException: SharedTokenCacheCredential authentication failed: AADSTS9002332: Application 'aa91afce-xxxx-xxxx-9529-74f450750af6'(Azure.CodeSigning) is configured for use by Azure Active Directory users only. Please do not use the /consumers endpoint to serve this request.


 Trace ID: 45c98608-2e54-4ea9-925b-5a13f8c4f100 Correlation ID: 3fc4814f-f344-42f7-919e-99d481e9fa0e Timestamp: 2025-03-06 11:07:25Z
 ---> MSAL.NetCore.4.61.3.0.MsalServiceException:
        ErrorCode: invalid_request
Microsoft.Identity.Client.MsalServiceException: AADSTS9002332: Application 'aa91afce-cb45-4805-9529-74f450750af6'(Azure.CodeSigning) is configured for use by Azure Active Directory users only. Please do not use the /consumers endpoint to serve this request. Trace ID: 45c98608-2e54-4ea9-925b-5a13f8c4f100 Correlation ID: 3fc4814f-f344-42f7-919e-99d481e9fa0e Timestamp: 2025-03-06 11:07:25Z
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<<RunAsync>b__1>d.MoveNext()
--- End of stack trace from previous location ---
   at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.ApiConfig.Executors.ClientApplicationBaseExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenSilentParameters silentParameters, CancellationToken cancellationToken)
   at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.ExecuteAsync[T](AbstractAcquireTokenParameterBuilder`1 builder, Boolean async, CancellationToken cancellationToken)
   at Azure.Identity.MsalPublicClient.AcquireTokenSilentCoreAsync(String[] scopes, String claims, IAccount account, String tenantId, Boolean enableCae, Boolean async, CancellationToken cancellationToken)
   at Azure.Identity.MsalPublicClient.AcquireTokenSilentAsync(String[] scopes, String claims, IAccount account, String tenantId, Boolean enableCae, Boolean async, CancellationToken cancellationToken)
   at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
        StatusCode: 400
        ResponseBody: {"error":"invalid_request","error_description":"AADSTS9002332: Application 'aa91afce-cb45-4805-9529-74f450750af6'(Azure.CodeSigning) is configured for use by Azure Active Directory users only. Please do not use the /consumers endpoint to serve this request. Trace ID: 45c98608-2e54-4ea9-925b-5a13f8c4f100 Correlation ID: 3fc4814f-f344-42f7-919e-99d481e9fa0e Timestamp: 2025-03-06 11:07:25Z","error_codes":[9002332],"timestamp":"2025-03-06 11:07:25Z","trace_id":"45c98608-2e54-4ea9-925b-5a13f8c4f100","correlation_id":"3fc4814f-f344-42f7-919e-99d481e9fa0e"}
        Headers: Cache-Control: no-store, no-cache
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
client-request-id: 3fc4814f-f344-42f7-919e-99d481e9fa0e
x-ms-request-id: 45c98608-2e54-4ea9-925b-5a13f8c4f100
x-ms-ests-server: 2.1.20139.6 - SEC ProdSlices
x-ms-clitelem: 1,9002332,0,38281451.1409,
x-ms-srs: 1.P
Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-YSKeKp5RS54ZWbWV3dzljQ' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
X-XSS-Protection: 0
Set-Cookie: fpc=ApYid5k3wldIue4oNX_1h2gO6F8CAQAAAO14W98OAAAA; expires=Sat, 05-Apr-2025 11:07:25 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly, stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
Date: Thu, 06 Mar 2025 11:07:25 GMT

   --- End of inner exception stack trace ---
   at Azure.Identity.CredentialDiagnosticScope.FailWrapAndThrow(Exception ex, String additionalMessage, Boolean isCredentialUnavailable)
   at Azure.Identity.SharedTokenCacheCredential.GetTokenImplAsync(Boolean async, TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.SharedTokenCacheCredential.GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
   at Azure.Identity.DefaultAzureCredential.GetTokenFromSourcesAsync(TokenCredential[] sources, TokenRequestContext requestContext, Boolean async, CancellationToken cancellationToken)

....
SignTool Error: An unexpected internal error has occurred.
Error information: "Error: SignerSign() failed." (-2147467259/0x80004005)

raelb 0 Reputation points

2025-03-06T15:45:40.26+00:00

Ideally I would like this to work without browser interaction, i.e. setting env variables
raelb 0 Reputation points

2025-03-08T18:29:49.24+00:00

@Raja Pothuraju I did manage to get it working. I needed to add a role assignment with the "Trusted Signing Certificate Profile Signer" and then select the registered app as a member. Now it works fine from the command line.

2 answers

Your answer

Raja Pothuraju 23,630 Reputation points Microsoft External Staff Moderator

2025-03-05T19:26:31.55+00:00

Hello @raelb,

Thank you for posting your query on Microsoft Q&A.

Based on your error I will recommend following the below steps to check if that works.

Try creating an additional tenant account through Entra Admin Center > Users > New User as a 'Member' with its own e-mail address as the 'Identity', then also create an app in Azure > Search > 'app registrations' > New Registration.

The latter provided a client ID, tenant ID, and 'secret' value necessary to complete the steps for authorization that Sign Tool would accept.

From there, three environment variables needed to be created within Windows (search > advanced system settings > Environment Variables).

The three value names are AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET and then each respective value needs to be assigned under each name.

a reboot is required to apply the new environment variables and with all of the other pieces in place as needed (certificate, signing profile, prerequisites, dlib, etc, etc, etc), SignTool could then code sign.

I hope this information is helpful. Please feel free to reach out if you have any further questions.
raelb 0 Reputation points

2025-03-06T15:45:40.26+00:00

Ideally I would like this to work without browser interaction, i.e. setting env variables
raelb 0 Reputation points

2025-03-08T18:29:49.24+00:00

@Raja Pothuraju I did manage to get it working. I needed to add a role assignment with the "Trusted Signing Certificate Profile Signer" and then select the registered app as a member. Now it works fine from the command line.

Answer 1

Meha-MSFT 1,165 Microsoft Employee Moderator

If you have multiple tenant ids/subscriptions with Azure. Please be sure to use the one where you have created Trusted Signing resources. Logout and log back in with the intended ids.

Answer 2

Meha-MSFT 1,165 Microsoft Employee Moderator

https://learn.microsoft.com/en-us/azure/trusted-signing/faq#common-error-codes-and-mitigations

raelb 0 Reputation points

2025-03-08T19:08:11.4033333+00:00

Thanks, that has some useful info

Share via

I receive the "Selected user account does not exist in tenant 'Microsoft Services'" error, when trying to sign an exe on my pc

2 answers

Your answer