Artifact Signing Account is giving SmartScreen at each release since march this year.

Question

Artifact Signing Account is giving SmartScreen at each release since march this year.

Dennis Lerche 10

Hi

We have been using the Azure Artifiact Signing for our releases for well over a year without any problems. However, since March it seems we are having problems like many other with our releases triggering the SmartScreen. Monday the latest where a hotfix was made for a release in May. It seems like the reputation has to be build up after each release (which uses a new certificate as they are only valid for some days), this poses a major problem for us, as our enterprise customers has strict security policies so they cannot do a "run anyways".

The result for the signtool verify /pa /v for the exe in question is shown below.

Verifying: ------
Signature Index: 0 (Primary Signature)
Hash of file (sha256): 16FC5EFD61BCE1A7715372AEF51D8FF84A205D33FA90240B0DBC93C28D7B8A57
Signing Certificate Chain:
    Issued to: Microsoft Identity Verification Root Certificate Authority 2020
    Issued by: Microsoft Identity Verification Root Certificate Authority 2020
    Expires:   Sun Apr 16 20:44:40 2045
    SHA1 hash: F40042E2E5F7E8EF8189FED15519AECE42C3BFA2
        Issued to: Microsoft ID Verified Code Signing PCA 2021
        Issued by: Microsoft Identity Verification Root Certificate Authority 2020
        Expires:   Tue Apr 01 22:15:20 2036
        SHA1 hash: 8E750F459DAF9A79D6370DB747AD2226866AD818
            Issued to: Microsoft ID Verified CS AOC CA 04
            Issued by: Microsoft ID Verified Code Signing PCA 2021
            Expires:   Wed Mar 26 20:11:29 2031
            SHA1 hash: 4C07413E5DA89A259A127E1D76F792AF239CD9D9
                Issued to: Suzlon Energy A/S
                Issued by: Microsoft ID Verified CS AOC CA 04
                Expires:   Wed Jun 24 07:15:13 2026
                SHA1 hash: 4BEE2295F4D823618C9FABB1BA8E5E6563D6C74E
The signature is timestamped: Mon Jun 22 16:32:19 2026
Timestamp Verified by:
    Issued to: Microsoft Identity Verification Root Certificate Authority 2020
    Issued by: Microsoft Identity Verification Root Certificate Authority 2020
    Expires:   Sun Apr 16 20:44:40 2045
    SHA1 hash: F40042E2E5F7E8EF8189FED15519AECE42C3BFA2
        Issued to: Microsoft Public RSA Timestamping CA 2020
        Issued by: Microsoft Identity Verification Root Certificate Authority 2020
        Expires:   Mon Nov 19 22:42:31 2035
        SHA1 hash: 27F0ABAC2877BA255F62B389B43FF539A0FB598E
            Issued to: Microsoft Public RSA Time Stamping Authority
            Issued by: Microsoft Public RSA Timestamping CA 2020
            Expires:   Thu Jan 07 20:59:03 2027
            SHA1 hash: 7587C337A84BB5BF291A58191AD102FFCDCF36BF
Successfully verified: -------
Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0

I also submitted the file for scanning, but it didn't help the SmartScreen is still being shown. We cannot deploy this application to the Microsoft Store to avoid this. What else can be done, besides discarding the use of Azure Artifact Signing and reverting back to buying a certificate each year from a vendor ?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Sangeetha Kesavan 20 Reputation points

2026-06-26T15:59:15.7166667+00:00
Hello Dennis,

Greetings!

Looking at the signtool output you shared, your file is signed correctly and chains to a valid Microsoft Identity Verification root, with the final leaf issued under "Microsoft ID Verified CS AOC CA 04." This points to a known platform side issue rather than anything wrong with your signing pipeline.

Since late March 2026, Azure Artifact Signing (formerly Trusted Signing) has been rotating customers through new intermediate CAs (AOC CA 03, EOC CA 03/04, and now AOC CA 04). Because Artifact Signing certificates are short lived and reissued for nearly every release, your binaries effectively get a new intermediate CA on a rolling basis. SmartScreen reputation is tracked per file hash and is influenced by the issuing CA's own accumulated trust signal, so when the backend assigns you a newer CA that has not yet built up reputation, every release can trigger "Windows protected your PC" warnings again, even though the signature itself verifies cleanly. This has been reported by multiple customers and is tracked publicly on GitHub, so it is not isolated to your account.

Here is what you can do while this is being worked through:

Confirm this is the CA rotation issue and not a local problem. Run signtool verify /pa /v on two or three consecutive releases and compare the "Issued by" line in the chain. If the intermediate CA name or thumbprint changes between releases that all show clean verification, that confirms the rotation is the cause rather than anything in your build or signing step.

Submit the specific file hash for a SmartScreen review as a short term workaround. This will not solve the recurring problem since each new release gets a new hash and certificate, but it can clear the warning faster for an individual release while you wait on a platform fix.

https://www.microsoft.com/en-us/wdsi/filesubmission

Do not disable SmartScreen or instruct customers to bypass it. Microsoft does not recommend this, and for your enterprise customers with strict policies it will not be an acceptable workaround anyway, so it is not worth pursuing as a solution path.

Track and add your details to the existing GitHub issue documenting this regression. Microsoft engineering is using this thread to correlate reports, and including your subscription details, certificate profile name, and the CA names from your verify output helps with diagnosis.

https://github.com/Azure/artifact-signing-action/issues/128

Open a formal Azure Support ticket against your Artifact Signing resource. Community Q&A reports help with visibility, but a support ticket tied to your subscription is the path that gets engineering to look at your specific certificate profile and confirm whether your account is pinned to an affected CA. Reference the GitHub issue number and the CA names (AOC CA 04 in your case) in the ticket description.

Review the official FAQ guidance on SmartScreen behavior for signed files, which Microsoft has been updating as this issue develops.

https://learn.microsoft.com/en-us/azure/artifact-signing/faq#what-can-i-expect-when-i-see-smartscreen-prompts-for-signed-files

Switching back to a yearly purchased EV certificate is not necessary at this stage. EV certificates no longer get an automatic SmartScreen bypass either, since Microsoft retired that benefit, so they would not reliably solve this for you and you would lose the CI/CD integration benefits of Artifact Signing. The CA rotation issue is the more likely root cause here and an Azure Support escalation is the right next step to get it resolved without abandoning the service.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Regards,
Sangeetha Kesavan
Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-14T22:14:13.83+00:00

Hello Dennis,

Thank you for the detailed information.

I understand that you're experiencing SmartScreen warnings on every release signed using Azure Trusted Signing (Artifact Signing), despite the signatures validating successfully and the files being correctly timestamped. I also understand the impact this has on your enterprise customers, particularly where security policies prevent users from selecting "Run anyway".

Microsoft has published guidance addressing SmartScreen behavior with signed files and Trusted Signing. Could you please review the following FAQ and verify whether the recommendations there have already been followed?

Microsoft Artifact/Trusted Signing FAQ – What can I expect when I see SmartScreen prompts for signed files?

https://learn.microsoft.com/azure/trusted-signing/faq#what-can-i-expect-when-i-see-smartscreen-prompts-for-signed-files

The article explains SmartScreen reputation behavior for signed applications and includes information about fixes and expected behavior when using Trusted Signing certificates.

Thanks
Moosa khan
Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-16T19:35:42.4466667+00:00

Hello Dennis,

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Christos Panagiotidis 3,381 Reputation points

2026-07-19T14:05:57.6233333+00:00

You confirmed the binary and hotfix are correctly signed and timestamped, so this is a reputation decision, not an Authenticode validation failure. SmartScreen considers publisher identity and each file hash; a valid signature does not guarantee that a new executable has established reputation.

Use the same Artifact Signing account, identity, and profile, and sign every executable and installer consistently. Submit each warned file to Microsoft Security Intelligence under Microsoft Defender SmartScreen, including its SHA-256 hash and clean SignTool output. Since the warning recurs across releases, open an Azure support request on the Artifact Signing resource with affected hashes, profile details, release dates, and screenshots, asking Microsoft to investigate.

An annual OV or EV certificate is not a guaranteed fix; current Microsoft guidance says EV certificates no longer bypass SmartScreen. With Store distribution unavailable, no supported setting forces immediate reputation. Do not advise users to disable or bypass SmartScreen.
Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-21T00:09:08.6166667+00:00

Hello Dennis,

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-14T22:14:13.83+00:00

Hello Dennis,

Thank you for the detailed information.

I understand that you're experiencing SmartScreen warnings on every release signed using Azure Trusted Signing (Artifact Signing), despite the signatures validating successfully and the files being correctly timestamped. I also understand the impact this has on your enterprise customers, particularly where security policies prevent users from selecting "Run anyway".

Microsoft has published guidance addressing SmartScreen behavior with signed files and Trusted Signing. Could you please review the following FAQ and verify whether the recommendations there have already been followed?

Microsoft Artifact/Trusted Signing FAQ – What can I expect when I see SmartScreen prompts for signed files?

https://learn.microsoft.com/azure/trusted-signing/faq#what-can-i-expect-when-i-see-smartscreen-prompts-for-signed-files

The article explains SmartScreen reputation behavior for signed applications and includes information about fixes and expected behavior when using Trusted Signing certificates.

Thanks
Moosa khan
Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-16T19:35:42.4466667+00:00

Hello Dennis,

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Christos Panagiotidis 3,381 Reputation points

2026-07-19T14:05:57.6233333+00:00

You confirmed the binary and hotfix are correctly signed and timestamped, so this is a reputation decision, not an Authenticode validation failure. SmartScreen considers publisher identity and each file hash; a valid signature does not guarantee that a new executable has established reputation.

Use the same Artifact Signing account, identity, and profile, and sign every executable and installer consistently. Submit each warned file to Microsoft Security Intelligence under Microsoft Defender SmartScreen, including its SHA-256 hash and clean SignTool output. Since the warning recurs across releases, open an Azure support request on the Artifact Signing resource with affected hashes, profile details, release dates, and screenshots, asking Microsoft to investigate.

An annual OV or EV certificate is not a guaranteed fix; current Microsoft guidance says EV certificates no longer bypass SmartScreen. With Store distribution unavailable, no supported setting forces immediate reputation. Do not advise users to disable or bypass SmartScreen.
Moosa Khan 605 Reputation points Microsoft External Staff Moderator

2026-07-21T00:09:08.6166667+00:00

Hello Dennis,

Following up to see if the provided information was helpful. If you have any further queries do let us know. we are happy to assist you further.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.