Azure Artifact Signing: Public Trust Certificate Profile Creation and Deletion Fails with ResourceOperationFailure / UnknownError

Creation and deletion of certificate profiles depend on a valid, usable Identity Validation and a healthy Artifact Signing account. When backend provisioning fails and leaves profiles stuck in a failed state, there is no portal/PowerShell/CLI operation documented that can “force delete” or repair those profiles client‑side.

From the available guidance:

1. Certificate profiles require a completed Identity Validation
   • A certificate profile can only be created if there is at least one completed Identity Validation in the subscription, and the profile must reference its Identity Validation ID.
   • The documented creation flow (for example with PowerShell) is:

          New-AzArtifactSigningCertificateProfile \
            -AccountName <account> \
            -ResourceGroupName <rg> \
            -ProfileName <name> \
            -IdentityValidationId <identity-validation-guid> \
            -ProfileType PublicTrustTest
     

   • The Identity Validation ID must be taken from the Artifact Signing account → Identity validations blade in the portal.
2. Deleting certificate profiles and accounts only works when the resource is in a normal state
   • Normal cleanup is supported:
     • Delete certificate profile from the Artifact Signing account → Certificate profiles → Delete.
     • Or via CLI/PowerShell:

              az artifact-signing certificate-profile delete -g MyResourceGroup --account-name MyAccount -n MyProfile
       

              Remove-AzArtifactSigningCertificateProfile -AccountName test -ResourceGroupName test -ProfileName test
       

   • These operations “stop any signing that’s associated with the certificate profile” and remove it when the service accepts the operation. They do not provide a documented override for resources stuck in a failed provisioning state.
3. Identity Validation and its impact on profiles
   • Identity Validation is shared across Artifact Signing accounts in the same subscription and is a prerequisite for profiles.
   • Deleting an Identity Validation:
     • Can only be done when it is not in “In Progress” state.
     • Stops renewal of linked certificate profiles across all accounts in the subscription and impacts signing.
     • Cannot be recovered once deleted.
   • The delete flow is portal‑only and assumes the service can enumerate and update linked profiles; it does not describe a way to clear already‑failed/stuck profiles.
4. No documented workaround for stuck/failed certificate profiles
   • The documentation covers:
     • Creating profiles (portal/PowerShell/CLI).
     • Deleting profiles and accounts (portal/PowerShell/CLI).
     • Deleting Identity Validations.
     • Revoking individual certificates under a profile.
   • It does not describe:
     • A remediation path for certificate profiles that are stuck in a failed provisioning state and cannot be deleted.
     • Any client‑side workaround for ResourceOperationFailure / UnknownError during profile creation or deletion.

Given this, when:

• Identity Validation is completed and correctly referenced, and
• Required roles are in place, and
• Microsoft.CodeSigning is registered, but
• Profile creation and deletion both fail with ResourceOperationFailure / UnknownError,

the issue is in the service backend and requires Microsoft support intervention. There is no documented self‑service workaround to repair or force‑delete those failed certificate profiles.

The only supported actions around them (create/delete profiles, delete account, delete Identity Validation, revoke certificates) all assume the service can process the request successfully; they do not address the failure mode described.

References:

• Artifact Signing resources and roles
• Quickstart: Set up Artifact Signing
• Renew or delete Artifact Signing Identity Validations
• Revoke a certificate profile in Artifact Signing
• Artifact Signing FAQ