Trusted Signing: signtool sign /dlib returns 'Access is denied' while the REST sign API returns 202 — Local execution issue

Problem description

I am experiencing an issue with artifact signing using Trusted Signing - Preview. When I try to sign Windows PE files with signtool sign /dlib, it returns 'Access is denied'. However, when I submit a direct REST sign request for the same identity, it is accepted with a 202 response. The failure occurs specifically during the local SignTool execution on my Windows VM, and there is no output from the dlib, including no version banner. I have verified that the files are accessible and that my account has the necessary permissions. The architecture of signtool and the dlib are matching, and I am using the latest client tools. I am seeking guidance on resolving this local execution issue to enable successful artifact signing.

Environment

Trusted Signing - Preview account in Switzerland North; Regional codesigning endpoint for Switzerland North; Public Trust certificate profile; Signing from a Windows VM; Authentication via service principal / app registration credentials.

What I've already tried

I attempted to sign Windows PE files using signtool sign /dlib with the local Azure.CodeSigning.Dlib.dll. The command failed with 'Access is denied', and the dlib produced no output. I also submitted a direct REST sign request from the same VM with the same credentials, which was accepted with a 202 response. I verified permissions and accessibility of the files involved and confirmed my account has the necessary rights. I also checked environment variables and ensured architecture compatibility between signtool and the dlib.

Current status

Currently, the issue persists with local signtool execution failing with 'Access is denied'. I am seeking further guidance on troubleshooting local runtime and configuration issues, including verifying signtool architecture, runtime dependencies, environment variables, and potential local security controls that might block the process.