Is it possible to migrate/merge trust of local USB EV Code Signing Certificate into Artifact Sigining?

Patryk Matuszewski 0 Reputation points
2026-11-03T13:37:57.5+00:00

Hello,

we plan to move our build/signing processes of desktop apps (WPF, VSTO) to Azure DevOps. The pipeline, msi creation, signing using the Artifact Siging is already working, but when the users try to install app there is Windows Smart Screen Warning.

Currently we have EV Code Siging Certificate on local USB with trust/reputation collected for 8 years. Is it possible to merge/move this trust into Artifact Signing Certificate?

Artifact Signing
Artifact Signing

A fully managed end-to-end service for digitally signing code, documents, and applications. (formerly Trusted Signing)

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-11-03T13:38:16.63+00:00

    No. Artifact Signing does not provide a way to migrate or merge SmartScreen reputation or certificate trust from an existing local USB EV code signing certificate into an Artifact Signing certificate.

    Supported facts from the documentation:

    • Artifact Signing signs with certificates managed by the service; it does not support exporting or importing certificates or private keys.
    • SmartScreen reputation builds automatically over time based on download history and behavior.
    • Artifact Signing does not provide instant SmartScreen trust.
    • EV certificates no longer bypass SmartScreen by default, and paying for EV solely to avoid SmartScreen warnings is no longer justified.
    • With Artifact Signing, signing consecutive releases with a consistent publisher/signing identity allows reputation to build over time so later releases can inherit trust.

    For the current scenario, the practical expectation is:

    1. Continue signing releases consistently with the same Artifact Signing identity.
    2. Expect SmartScreen warnings on new files until sufficient reputation accumulates.
    3. If warnings continue for a signed file, submit the signed file through Microsoft Security Intelligence for review.
    4. Retain the signed file and its hash, and consider subscribing to signing transaction events to help with troubleshooting.

    If the goal is immediate removal of SmartScreen warnings for public distribution, the only documented option that avoids SmartScreen warnings is Microsoft Store distribution, where apps are re-signed by Microsoft.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.