This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 40%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
My subscription was paused and re-enabled today (18 Sep 2026). Since then, every signing request to my Artifact Signing account (East US, Basic) fails:
Azure.RequestFailedException: Service request failed.
{"operationId":"f48ac4d2-c7da-4859-9a57-82dd8b1b039c","status":"Failed","signature":null,...}
SignTool Error: SignerSign() failed (0x80004005)
Authentication succeeds, and the failure comes at "Submitting digest for signing".
Everything I can check looks okay:
The same GitHub Actions pipeline (artifact-signing-action v2.0.0, client 1.0.128) signed successfully on 26 Aug. Nothing has changed except the pause and re-enable.
Has anyone seen the signing service keep refusing after a subscription is reactivated? Is there a way to clear it without a paid support plan?
Other failed operation IDs: 965304d7-000a-40f1-a5a4-924a2aab563f, 108d9cfa-3c16-4d5d-adf8-f2c6061d46f8
Update: I reproduced it outside the pipeline. Calling the data-plane sign API directly (api-version=2023-06-15-preview) from a different machine, with a different identity that holds the Certificate Profile Signer role, returns 202 Accepted, then the operation ends "status":"Failed" with errorResponse: null (operation ID ba9d6fa8-f613-4f0d-80cc-665b4b7b31fa). A fresh CI run later also failed the same way. So the pipeline, the credential and the network are ruled out: the account fails every sign operation, whoever submits it. Could someone from the Artifact Signing team check whether the account is still held after the subscription was re-enabled?
A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 30%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDM%3C/text%3E%3C/svg%3E)
For the paused and re-enabled accounts, it will take 1-2 days to re-active the signing. Please retry on 9/19 or 9/20.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 52%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
Have you checked for 403 and it's mitigations here: https://learn.microsoft.com/en-us/azure/artifact-signing/faq#common-error-codes-and-mitigations
Thanks. I've been through that list and the FAQ table. The subscription and the Microsoft.CodeSigning provider are Registered. The signer holds the Certificate Profile Signer role. The account and profile names are unchanged from when signing worked. Identity validation is Completed, and the certificate profile is Active, with a fresh certificate issued after the re-enable. It isn't a 403: every request returns 202 Accepted and the operation then ends "Failed" with errorResponse null. It also isn't machine- or auth-specific: calling the sign API directly from a different machine, with a different Signer identity and no SignTool, fails identically (operation ba9d6fa8-f613-4f0d-80cc-665b4b7b31fa). Could someone from the Artifact Signing team check the account's server-side state after the subscription re-enable?