Artifact Signing: users see SmartScreen on each release since intermediate CA rotated to a new (2026) CA

Question

We use Azure Artifact Signing (formerly Trusted Signing) in our release flow to sign our Windows app installer. Signing correctly embeds the signature and full certificate chain, and Get-AuthenticodeSignature reports Status: Valid, chaining to the Microsoft Identity Verification Root CA 2020.

This worked cleanly for months with no warnings. Starting ~2 months ago we've seen a large increase in SmartScreen warnings on every release. Users get scared and it's hurting our business.

Comparing the certificate chain across our releases we see: leaf identity is unchanged, but the Microsoft-assigned intermediate CA rotated from a 2021-era CA (with established SmartScreen reputation) to CAs created 2026-03-26 (no accumulated reputation). The warnings correlate exactly with that switch.

Release build date	Intermediate CA	Intermediate CA valid-from
2026-03-10	Microsoft ID Verified CS EOC CA 02	2021-04-13
2026-06-23	Microsoft ID Verified CS EOC CA 04	2026-03-26
2026-07-11	Microsoft ID Verified CS AOC CA 04	2026-03-26
2026-07-18	Microsoft ID Verified CS AOC CA 04	2026-03-26

Chain snapshot — March release (mature CA, no warnings):

Subject    : CN=<our leaf>, ...
Thumbprint : 1C616B54B532F9E34816480F93676CC624EE2A96
NotBefore  : 3/10/2026 3:41:59 PM
NotAfter   : 3/13/2026 3:41:59 PM

Subject    : CN=Microsoft ID Verified CS EOC CA 02, O=Microsoft Corporation, C=US
Thumbprint : 8BC0201379A2A31BA36EDD20223865C194A02174
NotBefore  : 4/13/2021 8:31:53 PM        <-- 2021 CA, established reputation
NotAfter   : 4/13/2026 8:31:53 PM

Subject    : CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US
Subject    : CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US
Status     : Valid

Chain snapshot — July release (new CA, SmartScreen warns):

Subject    : CN=<our leaf>, ...
Thumbprint : 639B33DD611C0A251599CEBBB2E8F619933D6D0C
NotBefore  : 7/18/2026 5:10:28 AM
NotAfter   : 7/21/2026 5:10:28 AM

Subject    : CN=Microsoft ID Verified CS AOC CA 04, O=Microsoft Corporation, C=US
Thumbprint : 4C07413E5DA89A259A127E1D76F792AF239CD9D9
NotBefore  : 3/26/2026 9:11:29 PM        <-- 2026 CA, no accumulated reputation
NotAfter   : 3/26/2031 9:11:29 PM

Subject    : CN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US
Subject    : CN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US
Status     : Valid

What we've already tried: Submitting individual file hashes to the SmartScreen file-submission form (https://www.microsoft.com/en-us/wdsi/filesubmission) does not help, each release is a new hash chaining through the same low-reputation CA, so the warning returns immediately.

Related reports: this matches the community thread at https://learn.microsoft.com/en-us/answers/questions/5929307/ and the GitHub issue at https://github.com/Azure/artifact-signing-action/issues/128.

Our questions:

• Can our profile be pinned to (or reissued under) a reputation-bearing CA?
• When are the 2026-03-26 CAs (EOC CA 03/04, AOC CA 03/04) expected to carry enough reputation to stop triggering SmartScreen?
• Is there any recommended mitigation besides waiting, given file-hash submission doesn't work for a per-release signing model?

Answer 1

Hello @Sonacove Meets
Thank you for providing the additional details and references.

Based on the information shared, we understand that your application was functioning without SmartScreen warnings prior to the intermediate CA rotation, and that the warnings began shortly after your signing chain transitioned from the older Microsoft ID Verified CS EOC CA 02 intermediate CA to newer Microsoft-issued intermediate CAs issued in March 2026. The certificate chain screenshots and validation result you provided show that the signatures remain valid and that the publisher identity has not changed. 

We also understand that you have already tested SmartScreen file submissions and observed that the warnings continue to reappear with each new release. As noted, each release generates a new file hash, which limits the effectiveness of file-specific reputation submissions for a continuous release model. 

Based on the evidence provided and the similarity to other publicly reported cases, the behavior appears consistent with scenarios where SmartScreen reputation is affected following a transition to newer intermediate certificate authorities. Multiple customers have reported comparable experiences after certificate chain rotations involving newer AOC/EOC intermediate CAs. 

At this time, there is no documented mechanism to manually select or pin a specific intermediate CA, nor is there published guidance that provides a definitive timeline for reputation propagation on newly introduced intermediate CAs. Continuing to sign releases consistently with the same signing profile and publisher identity remains the recommended approach while SmartScreen reputation signals mature over time. 

We appreciate the detailed analysis you have provided and understand the impact these warnings can have on the user experience. Should you observe any changes in behavior or obtain additional diagnostic information, please let us know and we will be happy to review it further.

Answer 2

Hi Sonacove,

What you're seeing is expected behavior when the signing certificate chain changes. Although your leaf code-signing certificate remains the same, a new Microsoft Verified ID intermediate CA starts with no SmartScreen reputation. SmartScreen reputation is influenced by both the file and the certificate chain, so a newly introduced intermediate can temporarily increase warnings until sufficient reputation is established.

If you're already submitting each release to the Microsoft Defender Security Intelligence portal, there isn't much else you can do to accelerate reputation. Continue signing consistently with the same publisher certificate, avoid unnecessary certificate changes, and allow reputation to build over time. If the warnings persist beyond a reasonable period, I'd recommend opening a Microsoft Support case to determine whether there's an issue with the new intermediate CA's reputation or SmartScreen evaluation.

Please "Accept the Answer" if the information helped you. This will help us and others in the community as well.