Does SmartScreen reputation accrue to the Artifact Signing identity validation, or reset when the service rotates the intermediate CA?

We sign a Windows installer with Azure Artifact Signing using a Public Trust certificate profile tied to a Completed organization identity validation. Signatures verify cleanly. I want to understand how SmartScreen reputation is expected to accumulate for a customer whose certificates rotate by design. I am not reporting a regression - see the note below, because I think it makes this question different from the others on this topic.

What I measured. I read the Authenticode chain directly off each published copy of our installer across nine days in July 2026. The leaf certificates were issued by three different intermediate CAs in that window:

• CN=Microsoft ID Verified CS AOC CA 03
• CN=Microsoft ID Verified CS EOC CA 03
• CN=Microsoft ID Verified CS AOC CA 04

Each leaf is valid for three days, and one leaf is reused across whatever builds ship that day. An earlier build on 5 July was on EOC CA 03, so the assignment moves in both directions rather than advancing. Every chain builds through CN=Microsoft ID Verified Code Signing PCA 2021 to CN=Microsoft Identity Verification Root Certificate Authority 2020. All builds are RFC3161 timestamped via timestamp.acs.microsoft.com, and signtool verify /v /debug /pa reports Valid on all of them.

Observed behaviour. Every build, downloaded in Microsoft Edge on a fresh browser profile, is withheld in the downloads list as "isn't commonly downloaded" until the user manually chooses Keep.

The part I think matters. Other threads here report that signing used to pass and started warning after a CA migration. That is not my case, and I checked carefully before posting. Our earlier "passing" result turned out to be a measurement artifact - the test had fetched the installer with Invoke-WebRequest, which never consults SmartScreen and cannot hold a file. When I re-tested properly in a browser, with a known-held build as a positive control, the old build was held exactly like the new one. We have never had a build that wasn't held. So I am not asking why something broke. I am asking whether accumulation is reachable at all under rotation.

Questions:

1. Does SmartScreen publisher reputation accrue to the durable identity validation, to the individual leaf certificate, or to the issuing intermediate CA? Microsoft Learn advises using "a consistent signing identity" and warns that "changing your signing certificate affects the publisher trust signal" - but Artifact Signing changes both the certificate and the intermediate CA on its own schedule, and the customer controls neither.
2. When the service moves a profile between intermediate CAs, is accumulated publisher reputation carried across, or does it start again?
3. Is there any supported way to pin a certificate profile to one intermediate CA, or to be assigned one that already carries reputation?
4. Azure/artifact-signing-action issue #128 describes CA migration causing SmartScreen warnings and has been open since March 2026 with no response. Is it tracking this, and what is its status?
5. Two Microsoft pages conflict on file submission. The Artifact Signing FAQ says to "consider submitting the signed file through Microsoft Security Intelligence for further review" when prompts persist. The SmartScreen reputation page says there is "no need (or mechanism) to manually submit a file for SmartScreen reputation review for consumer endpoints" and frames submission as an enterprise-admin path. Which applies to a publicly distributed consumer download signed with Artifact Signing?
6. Assuming one installer hash is held unchanged at a stable download URL, what is the expected path and rough timescale to the prompt stopping, given the certificate and intermediate CA will keep changing underneath it?