Does SmartScreen reputation carry over after deleting and recreating an Artifact Signing account?

Do not delete and recreate the Artifact Signing account if preserving SmartScreen reputation is important, because the resulting certificate profile receives a new durable profile identity and Microsoft does not document that publisher reputation transfers to it.

What is documented

• Deleting an Artifact Signing account also deletes all certificate profiles associated with it. The subscription-scoped identity-validation request remains available, but recreating the account does not restore the deleted profiles.^1^
• Certificates issued from one profile retain the same profile-specific EKU across their automatic daily renewals. If that profile is deleted and recreated, the replacement receives a new profile-specific EKU, even when it uses the same subscriber and identity-validation resource.^2^
• SmartScreen considers both publisher reputation and file-hash reputation. Microsoft states that reputation can transfer between releases when they are signed using the same publisher identity, while Artifact Signing reputation builds over time from downloads and behavior.^3^
• Artifact Signing documentation also describes reputation as tied to the verified publisher identity rather than an individual short-lived leaf certificate. Consequently, normal certificate renewal within an unchanged profile is not equivalent to deleting and recreating that profile.^4^

What this means for the recreated account

There is no published Microsoft guarantee that reusing the same identity validation causes SmartScreen to map a newly created account and profile back to the former reputation.

The evidence supports these distinctions:

• Automatic certificate renewal within the existing profile: profile identity remains stable; this is the continuity mechanism Artifact Signing provides.
• Delete and recreate the profile or account: the new profile has a different durable EKU. Treat SmartScreen reputation continuity as unconfirmed, not guaranteed.
• New signed binary: its file-hash reputation is new regardless; only the publisher signal could provide continuity.

Therefore, it is too strong to state definitively that the new profile “starts from zero,” but it is equally unsafe to assume reputation carries over merely because the legal identity or identity-validation resource is the same.

Recommended action

1. Keep the existing account and certificate profile whenever possible; allow Artifact Signing to rotate its short-lived certificates automatically.
2. If deletion is required, open an Azure support request before deleting and ask Microsoft to confirm whether SmartScreen publisher reputation will be associated with the replacement profile’s new durable EKU.
3. Include:
   • Existing Artifact Signing account and certificate-profile names.
   • Existing profile-specific EKU.
   • Planned replacement account/profile details.
   • Confirmation that the same subscription-scoped identity validation will be reused.
   • Representative hashes of currently signed files.
4. If the account was already recreated and warnings appear, continue signing consistently with the replacement profile. SmartScreen reputation builds automatically; the Artifact Signing FAQ also recommends submitting a persistently warned signed file through Microsoft Security Intelligence for review.^5^

Deleting a profile does not revoke certificates already issued from it or invalidate their existing signatures, although deleting the profile stops further signing through it.^5^

References

1. Quickstart: Set up Artifact Signing
2. Artifact Signing certificate management - Azure | Microsoft Learn
3. SmartScreen reputation for Windows app developers
4. Sign your MSIX package: end-to-end guide
5. Artifact Signing FAQ