Artifact Signing: SmartScreen 'unrecognized app' for binaries signed with Microsoft ID Verified CS AOC CA 03

David T 0 Reputation points
2026-09-07T05:32:11.81+00:00

We publish a Windows desktop application and sign it with Azure Artifact Signing (Public Trust). Organization identity validation completed successfully on 1 September 2026. The application executable and the NSIS installer are both signed and RFC 3161 timestamped, and signature verification passes cleanly.

Certificate subject: CN=[company name], O=[company name], L=[city], S=[state], C=US

Issuing CA: Microsoft ID Verified CS AOC CA 03

Get-AuthenticodeSignature reports Status: Valid, and Windows correctly displays our company name as the publisher. Despite that, SmartScreen still shows "Windows protected your PC - Microsoft Defender SmartScreen prevented an unrecognized app from starting", and Microsoft Edge reports that the download "isn't commonly downloaded".

I understand that newly published files must accumulate reputation. What I would like to establish is whether this is ordinary reputation building for a new publisher, or whether we are affected by the reputation propagation problem reported for the intermediate CAs introduced on 26 March 2026 (AOC CA 03, AOC CA 04, EOC CA 03, EOC CA 04). Several threads here describe long-established publishers losing reputation immediately after that rotation. A Microsoft reply in June 2026 stated the propagation issue had been corrected, but a July 2026 thread reports warnings still appearing on every release.

My questions:

  1. Is SmartScreen reputation propagation for Microsoft ID Verified CS AOC CA 03 fully restored, or is that work still in progress?
  2. For a genuinely new publisher on this CA, is there anything beyond distributing normally and signing every release with the same profile that we should be doing?
  3. Is there any guidance at all on the volume of downloads or elapsed time that is typical before the warning clears on these newer CAs?

I have deliberately left our company name, Artifact Signing account name, identity validation ID and subscription ID out of this public post. I am glad to provide all of them privately to a Microsoft engineer who can look up our records. Thank you.

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-09-07T05:32:27.26+00:00

    What is supported by the available documentation:

    1. SmartScreen reputation is not instant for Azure Artifact Signing, including Public Trust. New files can show SmartScreen warnings until sufficient reputation is built. Microsoft states that Artifact Signing does not provide instant SmartScreen trust, and that reputation accumulates over time based on download volume and behavior.
    2. For a new publisher, the behavior described is ordinary and expected. A valid signature, RFC 3161 timestamp, and a verified publisher name confirm signing and identity, but they do not by themselves suppress SmartScreen. Microsoft explicitly states that signed files can still show SmartScreen prompts until the file hash or publisher identity has enough reputation.
    3. The documented guidance is to keep signing releases with a consistent verified identity. Microsoft states that signing consecutive releases with the same publisher/signing identity allows publisher reputation to build over time so later releases can inherit trust, rather than starting from zero each time.
    4. There is limited published guidance on timing/volume. The only concrete guidance in the provided documentation is that this is expected for new publishers and can take typically several weeks and hundreds of clean installs before sufficient reputation is built.
    5. If SmartScreen prompts continue, Microsoft recommends submitting the signed file for review through Microsoft Security Intelligence.

    What is not supported by the available documentation:

    • No published confirmation is provided here about the specific status of reputation propagation for Microsoft ID Verified CS AOC CA 03.
    • No published statement is provided here about whether any March 2026 intermediate CA propagation issue is fully restored or still in progress.
    • No additional documented action is provided beyond normal distribution, consistent signing identity, and optional submission for review if prompts persist.

    Practical answer to the three questions:

    1. AOC CA 03 restoration status: no supported public statement is available here.
    2. What to do beyond normal distribution: keep signing every release with the same verified profile/identity; if prompts persist, submit the signed file through Microsoft Security Intelligence for further review.
    3. Typical time/download volume: Microsoft documents only a broad expectation of several weeks and hundreds of clean installs for new publishers.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.