Artifact Signing: every sign operation returns "status":"Failed" after subscription was reactivated

David Thibodeaux 0 Reputation points
2026-10-13T23:29:46.01+00:00

My Pay-As-You-Go subscription was disabled for a past-due payment. I paid and reactivated it today (2026-10-13); it now shows Enabled. Since then, Artifact Signing on that subscription accepts sign requests but every operation fails with no signature. Signing worked normally with the same setup before the subscription was disabled.

Setup:

  • Artifact Signing account in East US (Basic SKU), endpoint https://eus.codesigning.azure.net/
  • One Public Trust certificate profile, status Active. A new certificate was issued today after reactivation (it had stopped issuing while the subscription was disabled).
  • Individual identity validation: Completed, valid until 2027.
  • Signing with a service principal that has the Artifact Signing Certificate Profile Signer role on the account.

What happens:

The request is accepted (HTTP 200), the operation goes to InProgress, then ends with: {"operationId":"e7cdd4b3-a196-407e-8aea-1f465f57528c","status":"Failed","signature":null,"signingCertificate":null,"counterSignature":null} SignTool then reports SignerSign() failed (0x80004005).

What I've ruled out:

  • It fails for any file, including a freshly compiled 3 KB "hello world" exe, so it isn't the file.
  • It fails with both the old TrustedSigning module (client 1.0.95) and the current ArtifactSigning module (client 1.0.128).
  • Authentication and permissions are fine: right after reactivation requests returned 403, and now they return 200 and create an operation.
  • It has been failing consistently for about 9 hours since reactivation, retried hourly.

Failed operation IDs:

  • e7cdd4b3-a196-407e-8aea-1f465f57528c
  • 22aa60ff-c525-419d-b4b5-49b16b8bee92
  • 2ebedd30-67b8-4d74-97b2-b85143e68add
  • a10a06b3-b7f2-436e-9f29-796af6daeaa6

Is there something that has to be reset on the Artifact Signing side after a subscription is reactivated? I don't have a paid support plan, so a free billing ticket was declined as technical. Could someone from the Artifact Signing team look up these operations?

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-13T23:31:33.8366667+00:00

    There is no documented customer-side reset for Artifact Signing after subscription reactivation; capture one failed transaction with diagnostics enabled and submit the operation evidence for an Artifact Signing technical investigation.

    Capture a diagnostic transaction

    1. In the Azure portal, open the Artifact Signing account.
    2. Select Monitoring → Diagnostic settings → + Add diagnostic setting.
    3. Enter a setting name.
    4. Under Logs → Categories, select Sign Transactions.
    5. Under Destination details, select Archive to a storage account, choose the subscription and storage account, and select Save.
    6. Wait 10–15 minutes, then reproduce the failure once.
    7. Open the storage account and select Data storage → Containers → insights-logs-signtransactions. Navigate to the reproduction date and time and download the transaction log. These are the documented steps for collecting Artifact Signing transaction records.^1^

    Preserve:

    • Operation ID and exact UTC timestamp.
    • Artifact Signing account and certificate-profile names.
    • Region and endpoint.
    • Client/module version.
    • Authentication method.
    • Test file and its SHA-256 hash.
    • The downloaded Sign Transactions record.
    • The date and approximate UTC time when the subscription changed back to Enabled.

    Microsoft specifically recommends retaining the file and hash together with signing-transaction data for troubleshooting.^2^

    Check the one applicable 0x80004005 condition

    The Artifact Signing FAQ maps SignerSign() failed with -2147467259/0x80004005 to a configuration check when the service principal uses certificate-based authentication: verify the Azure Identity environment variables required for service-principal certificate authentication.^2^

    Apply this only if that is your authentication mode. If the service principal uses a client secret, workload identity, or another credential, this mitigation does not apply. Because the service accepts the request and later fails the operation, do not repeat the file, module-version, RBAC, or general authentication tests already completed.

    As a low-probability control-plane check, verify Subscriptions → your subscription → Settings → Resource providers → Microsoft.CodeSigning still shows Registered. Registration is required for Artifact Signing, although the accepted operations make this less likely to explain the failure.^3^

    Escalate the failed operations

    Open the Artifact Signing resource and select Support + Troubleshooting → Create a support request. Choose Technical, select Artifact Signing or the closest available service classification, and attach the evidence above. Select the affected subscription because the assigned engineer can inspect only resources in the subscription specified on the case.^4^

    Creating the request requires subscription-level Owner, Contributor, Support Request Contributor, or equivalent Microsoft.Support/* permission. Azure subscription-management support is included, but technical support normally requires a support plan.^4^

    Without a technical support plan:

    • Update this Microsoft Q&A post with the diagnostic transaction details, UTC timestamps, and operation IDs, using the Artifact Signing tag. Do not publish subscription IDs, tenant IDs, secrets, certificates, or other account-sensitive information.
    • Q&A is a documented Artifact Signing assistance channel, but it does not guarantee backend inspection or routing to the service team; an Azure technical case is the authoritative route for examining operation IDs.^2^
    • A billing request may verify whether subscription entitlement reactivation completed, but it may again classify inspection of failed signing operations as technical.

    Microsoft states that subscription reactivation itself can take up to 24 hours. Once reactivated, most resources resume automatically; delays in creating or managing resources beyond 30 minutes can be raised with Billing Support.^5^ That guidance does not establish a 24-hour Artifact Signing recovery period or confirm that these data-plane failures are a billing issue. Since the subscription already shows Enabled and signing has failed for nine hours, collect and escalate now rather than treating further waiting as the fix.

    Do not delete or recreate the account/profile as an initial workaround. Artifact Signing resources cannot be migrated across subscriptions, tenants, resource groups, or resources; changing the subscription or tenant requires recreating the resources.^2^

    References

    1. Access signed transactions in Artifact Signing
    2. Artifact Signing FAQ | Microsoft Learn
    3. Quickstart: Set up Artifact Signing
    4. Create an Azure support request
    5. Reactivate a disabled Azure subscription
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.