Unable to get artifact signing to work.

A 403 from Artifact Signing indicates authorization or configuration issues rather than a generic failure. Based on the documented mitigations, focus on these checks rather than tracing the HTTP call itself:

1. Confirm subscription registration
   The Azure subscription that hosts the Artifact Signing account must be in status Registered for the Artifact Signing resource provider. A non-registered subscription is a documented cause of 403.
2. Verify the signer identity and role assignment
   The identity that SignTool is actually using must have the Artifact Signing Certificate Profile Signer role on the Artifact Signing certificate profile.
   • Ensure that this role is assigned to the same user/service principal that is resolving via DefaultAzureCredential when SignTool runs.
   • For Private Trust scenarios, 403 can occur if the user object ID that signs is different from the user object ID that calls Get-azCodeSigningRootCert. The appropriate object ID must have the Artifact Signing Certificate Profile Signer role.
3. Validate metadata.json configuration
   The JSON file must correctly reference:
   • Endpoint that matches the region where both the Artifact Signing account and certificate profile were created.
   • CodeSigningAccountName that matches the Artifact Signing account name.
   • CertificateProfileName that matches the certificate profile name. A mismatch in account name or certificate profile name is a documented cause of 403.
4. Check dlib, SignTool, and runtime versions
   403 can also be triggered by client-side issues:
   • Confirm the Artifact Signing dlib package is correctly installed and referenced (path and name).
   • Use Windows SDK SignTool.exe version 10.0.2261.755 or later.
   • Ensure .NET 8 Runtime and Microsoft Visual C++ Redistributable are installed.
5. Verify certificate profile and identity validation status
   • Identity validation must have a status of Completed.
   • The certificate profile must be Active.
     If either is not in the required state, signing requests can fail with 403.
6. Check network access to the endpoint
   Confirm that the machine running SignTool can reach the Artifact Signing endpoint. The documentation notes that 403 may indicate a network issue; try the same operation from another machine or VM to rule out local firewall/proxy problems.
7. Exclude conflicting credentials only as needed
   Adding "ExcludeCredentials": ["VisualStudioCredential"] is appropriate if Visual Studio is logged in with a different identity, but 403 indicates the effective identity still lacks required permissions or configuration. If working outside Azure, consider excluding ManagedIdentity as well when you see Azure.Identity.CredentialUnavailableException, though that is a different error than 403.

If all of the above are correct and 403 persists, the next step is to open an Azure support ticket for Artifact Signing so the backend logs can be reviewed, as client-side tracing will not expose the full cause of a 403 from the service.

References:

• Artifact Signing FAQ
• Set up signing integrations to use Artifact Signing
• Sign your MSIX package: end-to-end guide