Azure Artifact Signing for international applicants

A Pakistan-registered sole proprietorship is not currently eligible for Azure Artifact Signing Public Trust, and the documented onboarding process provides no country-restriction exception or manual-verification route that can override this eligibility requirement.

Current eligibility

Public Trust organization certificates are currently available only in the United States, Canada, the European Union, the United Kingdom, Australia, New Zealand, Japan, South Korea, Singapore, Switzerland, Norway, and Israel. Pakistan is not included. Individual-developer validation is more restricted and requires the developer to be located in the United States or Canada.^1^

The FAQ directs applicants whose country is absent from the identity-validation list back to those geographic prerequisites; it does not describe an exception application.^2^

Consequently:

• Pakistani FBR, NTN, and business-registration documents cannot independently establish eligibility while Pakistan remains outside the supported-country list.
• Registering an Artifact Signing account in a supported Azure region does not change the applicant organization’s geographic eligibility. Service deployment region and identity-validation eligibility are separate requirements.
• The sole-proprietorship structure does not provide a documented bypass through individual validation, because individual applicants must be in the US or Canada.

Manual review versus a geographic exception

Artifact Signing can request additional documents when its validation team cannot determine an eligible applicant’s identity. That is part of identity verification after an eligible request has entered validation; it is not documented as a mechanism for admitting an organization from an unsupported country.

The FAQ also states that if the validation team cannot validate the submitted information, onboarding cannot proceed—even after additional documents are supplied.^2^

There is no documented self-service exception, specialist-review application, or alternative identifier that converts Pakistani registration documents into supported-country eligibility.

Suitable alternatives for public website distribution

For EXE or installer distribution directly from a public website, Private Trust is not an equivalent substitute. Private Trust certificates are not default-trusted by Windows and are intended for opt-in, internal, line-of-business, and application-control scenarios. Public Trust is the Artifact Signing model intended for publicly distributed Win32 applications.^3^

The practical alternatives are:

1. Obtain a publicly trusted OV code-signing certificate from another certificate authority that accepts Pakistani businesses. Microsoft’s Windows signing guidance lists an OV certificate from a CA as the production-distribution alternative to Artifact Signing.^4^
   Confirm directly with the CA:
   • Pakistan and sole-proprietor eligibility;
   • whether NTN/FBR documents are accepted;
   • whether signing can be performed through a hosted/cloud key rather than locally attached hardware;
   • support for Authenticode-signing EXE, DLL, MSI, or your installer format.
2. Use Microsoft Store distribution where applicable. The Store signs an MSIX package during submission.^4^ This changes the distribution channel and therefore does not meet a strict requirement to distribute only from your own website.
3. Do not use Public Trust Test or Private Trust for production public downloads. Public Trust Test is not publicly trusted, while Private Trust requires relying systems to opt into its trust chain.^3^

The available Microsoft documentation does not identify another Microsoft-operated, publicly trusted cloud-signing service for an applicant who is geographically ineligible for Artifact Signing Public Trust.

Roadmap and definitive eligibility assessment

No public Microsoft announcement in the available documentation commits to adding Pakistan or gives an expansion date. Country support can change, so monitor the Artifact Signing quickstart’s Prerequisites section rather than relying on older Q&A statements.^1^

Since Azure Sales has already referred the enquiry, the additional official route is:

1. Azure portal → Help + support → Create a support request.
2. Select the service/category for Azure Artifact Signing and Identity validation/onboarding.
3. Ask for a written determination covering:
   • organization Public Trust eligibility for a Pakistan-registered sole proprietorship;
   • whether any non-public pilot or supported exception exists;
   • whether FBR/NTN documents can be reviewed despite the country restriction;
   • whether Pakistan has a published onboarding timeline.
4. Include subscription and tenant details in the private support case, not in Microsoft Q&A.

Azure Support and Microsoft Q&A with the Artifact Signing tag are the documented support channels; Azure Support is the appropriate channel for an applicant-specific eligibility determination.^2^

References

1. Quickstart: Set up Artifact Signing | Microsoft Learn
2. Artifact Signing FAQ
3. Artifact Signing trust models
4. Sign an MSIX package