Azure Artifact Signing fails with AzureCliCredential timeout

Artifact Signing’s interactive signing flow requires a Microsoft Entra work or school identity, so create a member work account in the signing subscription’s existing tenant if that tenant permits it, assign it the signer role, and authenticate Azure CLI explicitly against that tenant.^1^

Keep the existing signing resources if possible

First identify the Microsoft Entra tenant associated with the subscription containing the Artifact Signing account. Every Azure subscription trusts one tenant, which supplies the identities used for Azure RBAC.^2^

If you can administer that tenant:

1. Sign in to the Microsoft Entra admin center with an account holding User Administrator or higher.
2. Go to Entra ID → Users → New user → Create new user.
3. Create a member account such as [Email]; do not invite the Hotmail address as another guest. Record its temporary password.^3^
4. In Azure portal, open Artifact Signing Accounts → your account → Access Control (IAM) → Add → Add role assignment.
5. Assign Artifact Signing Certificate Profile Signer to the new member user. The assigner must have permission to manage role assignments, such as Owner or User Access Administrator.^4^

Assigning a new signer does not create another identity-validation request. Identity validation establishes the identity represented by the certificates; the signer role separately authorizes a tenant identity to use a certificate profile.^5^ Therefore, when the existing account and profile remain under the same subscription and tenant, the completed validation and active profile can continue to be used.

Being Owner or Contributor alone is not sufficient to sign; the work account specifically needs Artifact Signing Certificate Profile Signer.

Authenticate against the correct tenant

Discard the personal-account CLI session and target the signing subscription’s tenant explicitly:

az logout
az account clear
az login --tenant <tenant-id-or-domain>
az account set --subscription <subscription-id>
az account show

The --tenant value can be either the tenant ID or its .onmicrosoft.com domain.^6^

Confirm that az account show reports:

• the subscription containing the existing Artifact Signing account;
• the expected tenant;
• the new work-account identity.

Then rerun SignTool. Artifact Signing’s SignTool integration uses DefaultAzureCredential, which can obtain the token through AzureCliCredential.^7^

Optional: restrict authentication to Azure CLI

If the client continues spending time on other credentials before reaching Azure CLI, add ExcludeCredentials to metadata.json. Leave AzureCliCredential out of the exclusion list:

{
  "Endpoint": "<account-endpoint>",
  "CodeSigningAccountName": "<account-name>",
  "CertificateProfileName": "<profile-name>",
  "ExcludeCredentials": [
    "EnvironmentCredential", "ManagedIdentityCredential",
    "WorkloadIdentityCredential", "SharedTokenCacheCredential",
    "VisualStudioCredential", "VisualStudioCodeCredential",
    "AzurePowerShellCredential", "AzureDeveloperCliCredential",
    "InteractiveBrowserCredential"
  ]
}

Use only credential names supported by the installed Artifact Signing client version. This is an authentication-chain optimization, not a substitute for creating the work identity, targeting the correct tenant, and assigning RBAC.

If the current tenant cannot host a member work account

Create a new workforce Microsoft Entra tenant:

1. Azure portal → Microsoft Entra ID → Overview → Manage tenants → Create.
2. Choose Microsoft Entra ID, not B2C.
3. Enter the organization name, initial .onmicrosoft.com domain, and country/region.^8^
4. Create the member signer account in that tenant.
5. Ensure the account performing the transfer exists in both the old and new directories and is Owner of the subscription.
6. Change the existing subscription’s directory to the new tenant.

Directory transfer is disruptive: existing Azure RBAC assignments and custom roles are permanently deleted rather than transferred, and affected managed identities, Key Vaults, and other tenant-bound resources can require repair.^9^ Recreate the required roles afterward, including Artifact Signing Certificate Profile Signer.

The Azure resources remain subscription resources, but before relying on the existing validation after a directory transfer, inspect the Artifact Signing account and confirm that identity validation is still Completed and the certificate profile is active. If either state changes, open an Azure support request rather than submitting another validation request; the FAQ directs cases requiring another validation for the same identity to support.^10^

References

1. How to get Artifact Signing working with personal account - Microsoft Q&A
2. Associate or add an Azure subscription to your Microsoft Entra tenant
3. How to create, invite, and delete users
4. Tutorial: Assign roles in Artifact Signing
5. Artifact Signing resources and roles
6. Sign into Azure interactively using the Azure CLI
7. Set up signing integrations to use Artifact Signing
8. Quickstart: Create a new tenant in Microsoft Entra ID
9. Transfer an Azure subscription to a different Microsoft Entra directory
10. Artifact Signing FAQ