The general Entra Verified ID partner gallery is not an Artifact Signing compatibility list. Artifact Signing is the relying party, and its presentation request determines the accepted credential type and issuer. A Verified ID obtained independently from another partner will not satisfy the flow unless Artifact Signing explicitly trusts that issuer; there is currently no documented self-service option to select another issuer.

The current Public Trust representative workflow documents AU10TIX and Microsoft Authenticator. It also has no documented document-only route that bypasses the identity and liveness step. Supplemental identity or address documents are part of that verification, not an alternative to it. If declining the AU10TIX consent ends the flow, there is no supported portal setting to separate that consent or continue with another provider.

Because this is a privacy and consent requirement rather than a document-validation failure, avoid repeated submissions. Open an Artifact Signing support request and ask for written confirmation of accepted issuers and an alternative verification route. Include the validation ID and jurisdiction, but no identity documents. Until Microsoft provides another supported flow, Private Trust is the Artifact Signing option that avoids Public Trust identity validation, although its certificates are not publicly trusted for external software distribution.

Unfortunately, answer to all your questions is no.

Getting Your Software Trusted on Windows

A step-by-step guide to code signing and SmartScreen reputation — with no selfie or biometric ID check required

Prepared August 2026 · Written for non-experts: no prior knowledge of certificates is assumed.

1. The problem, in plain English

When someone downloads your program and runs it, Windows shows a blue warning screen ("Windows protected your PC") if it doesn't recognise the software. This warning system is called Microsoft Defender SmartScreen. It goes away when two things are true:

• A. Your software is digitally signed with a certificate that proves who published it, and
• B. Enough people have downloaded and installed it that SmartScreen has built up reputation for your signature.

To get the certificate in (A), a company must verify your identity. Some verification routes make an individual person photograph their passport and take a video selfie, which is processed by a third-party biometric company (AU10TIX). You can avoid that entirely by verifying as an organisation (a registered company) instead of as an individual. Organisation checks are done with business paperwork and a phone call — no photos of anyone's face.

One more useful fact: the expensive "EV" certificates (which require the strictest personal identity checks) used to skip SmartScreen warnings instantly. Microsoft removed that benefit in 2024. EV and standard certificates now build reputation the same way, so there is no reason to go through the harsher EV identity process. Reference: Microsoft: Code signing options.

2. Before you start: a short checklist

Gather these first. Having them consistent and ready is the single biggest time-saver.

1. A registered company. In the UK this means a company registered with Companies House (gov.uk – Companies House). If you don't have one yet, registering a limited company online costs £50 and usually completes within 24 hours.
2. Matching public records. The company name and address you type into any application form must match your Companies House record exactly — same spelling, same punctuation, same address.
3. A verifiable business phone number. Verification teams look your company up in public directories and call you back on the listed number. Make sure your business phone number is listed under your exact company name (e.g., in a public phone directory or a business listing service) before applying.
4. A company website and domain. Ideally, your domain's public WHOIS registration record shows your company name. Your domain registrar's control panel is where you check this.
5. A company email address on that domain (e.g., ******@yourcompany.co.uk), not a personal Gmail address.

3. Choose your route (we recommend Route A)

Both routes produce a certificate that all Windows machines trust. Neither requires a selfie when you verify as an organisation.

4. Route A: Azure Artifact Signing, step by step

Official documentation: learn.microsoft.com/en-us/azure/artifact-signing — keep this open in another tab as you go.

Part 1 — Set up the account

1. Create an Azure account at azure.microsoft.com/free. Use your company email address, not a personal one. You will need a credit/debit card; the signing service itself is about $9.99/month.
2. Sign in to the Azure Portal at portal.azure.com.
3. In the search bar at the top, type Artifact Signing (it may also appear as Trusted Signing) and select it, then click Create. Pick a subscription, create a new "resource group" (a folder — any name is fine, e.g., signing), choose a region near you (e.g., West Europe), give the account a name, and click Review + Create.

Part 2 — Verify your company (the important part)

4. Open your new signing account and find Identity validations in the left menu. Click New identity validation.
5. Choose "Organisation" as the validation type — not "Individual". This is the fork in the road. The Individual route is the one that sends you a QR code for a passport-and-selfie check with AU10TIX. The Organisation route asks for business documents instead.
6. Fill in your company's legal name, address, and website exactly as they appear at Companies House. Submit the request.
7. Microsoft's verification team may email you asking for one supporting document, such as: a letter from an authorised representative of the company, or your domain's WHOIS ownership record. Reply promptly with what they ask for. Verification typically takes a few hours to a few business days.

If at any point in this process you are shown a QR code or asked to photograph an ID document or your face, stop — you are in the Individual flow by mistake. Cancel, go back, and re-submit as an Organisation validation.

Part 3 — Create the certificate profile

8. Once the validation email says "Completed", go to Certificate profiles in your signing account and click Create.
9. Choose Public Trust as the profile type. ("Private Trust" is only for software used inside your own company and will NOT stop warnings for the public.) Link it to your completed identity validation and save.

Part 4 — Sign your program

10. On the computer where you build your software, install the .NET SDK from dotnet.microsoft.com/download, then open a Command Prompt / PowerShell window and run:

        dotnet tool install --global sign --prerelease
    

11. Sign your installer and program files with a command like this (replace the account name, profile name and file name with yours — your endpoint URL is shown on the signing account's overview page):

        sign code artifact-signing MyInstaller.exe ^
          --artifact-signing-endpoint https://weu.codesigning.azure.net/ ^
          --artifact-signing-account YOUR-ACCOUNT-NAME ^
          --artifact-signing-certificate-profile YOUR-PROFILE-NAME ^
          --timestamp-url http://timestamp.acs.microsoft.com
    

12. Sign every file a user runs: the installer (.exe or .msi), the main application .exe, and any updater program. A friendly walk-through with screenshots (including automatic signing from GitHub) is here: Scott Hanselman's guide.

5. Route B: OV certificate from a traditional provider

Use this route if you'd rather not use Microsoft's cloud service. The example below uses Sectigo; SSL.com and others work very similarly.

1. Buy an "OV Code Signing" certificate (sometimes labelled "Organization Validation" or "standard" code signing). Do not buy "Individual" code signing — that is the tier that requires a photo ID and selfie. Sectigo's product page: sectigo.com – Code Signing.
2. During the order, enter your company details exactly as registered at Companies House.
3. The provider's validation team will then: (a) check your company in official registries, (b) confirm your business address, and (c) make a verification phone call to your publicly listed business number and ask the named contact to confirm the order. What to expect is described here: Sectigo: What to expect during OV validation.
4. When validation completes, the certificate is delivered on a USB hardware token posted to you (industry rules require the private key to live on secure hardware). Keep it safe — it IS your signing identity.
5. To sign, plug in the token and use Microsoft's free SignTool (installed with the Windows SDK, documentation here):

       signtool sign /n "Your Company Ltd" /fd SHA256 ^
         /tr http://timestamp.sectigo.com /td SHA256 MyInstaller.exe
   

6. Making the warnings go away (SmartScreen reputation)

A brand-new certificate starts with zero reputation, so the very first downloaders may still see a SmartScreen prompt — but now it will display your verified company name, and the warnings fade as installs accumulate (often within days of real-world use). Microsoft's explanation: SmartScreen reputation for app developers.

1. Always sign with the same certificate/profile. If you delete and recreate the certificate profile, SmartScreen treats your software as brand new and warnings can return. One identity, kept forever.
2. Host downloads at one stable HTTPS address on your own domain, and don't keep changing the URL.
3. Timestamp every signature (the timestamp option in the commands above does this). It keeps signatures valid even after the certificate itself expires.
4. Ask Microsoft to review your file. You don't have to wait passively — submit your signed installer for analysis as a software developer here: microsoft.com/en-us/wdsi/filesubmission (choose "Software developer" as the submission type). This often speeds up reputation for legitimate software.
5. Optional shortcut: if your app can be packaged for the Microsoft Store, Store downloads are signed by Microsoft itself and skip SmartScreen entirely, while your website downloads build reputation in parallel. Starting point: Publish Windows apps.

7. One-page summary

Product names, prices and procedures were checked in August 2026 and may change — the Microsoft and Sectigo pages linked above are the authoritative, up-to-date sources.