Trusted Signing: Regression in SmartScreen reputation following transition to "Microsoft ID Verified CS EOC CA 03"

https://learn.microsoft.com/en-us/azure/artifact-signing/faq#what-can-i-expect-when-i-see-smartscreen-prompts-for-signed-files

Hello Gregory N,

Thank you for the detailed information and for validating the certificate chain on your end.

Based on our investigation, the behavior you observed was related to a Microsoft-side reputation propagation issue associated with the rollout of new Azure Trusted Signing intermediate certificate authorities on March 26, 2026 (Microsoft ID Verified CS AOC CA 03, EOC CA 03, and EOC CA 04).

During the transition to these new intermediate CAs, SmartScreen reputation that had previously been established for signed applications was not consistently propagated to the new certificate chain. As a result, applications that were previously recognized and trusted by SmartScreen, including your ExamDiff Pro binaries, could unexpectedly display the "Microsoft Defender SmartScreen prevented an unrecognized app from starting" warning despite being properly signed and validated.

We would like to confirm that this issue has been addressed by the Microsoft engineering teams. Reputation propagation for the new intermediate CAs has been corrected, and no changes are required to your Trusted Signing account, signing profile, or signing workflow.

To validate the resolution, we recommend the following:

• Re-sign and publish a current build using your existing Azure Trusted Signing profile.
• Download the newly signed binary on a clean test machine.
• Verify that the SmartScreen warning is no longer presented.
• Continue signing future releases using the same Trusted Signing profile to maintain reputation continuity for your publisher identity.

For additional context, SmartScreen reputation is evaluated on multiple signals, including file hash reputation and publisher reputation. Following recent program changes, Extended Validation (EV) certificates no longer automatically bypass SmartScreen checks. Therefore, newly released binaries may still experience a temporary reputation-building period until sufficient download and usage signals are established. This behavior is expected and is separate from the issue described above.

If you continue to observe SmartScreen warnings after re-signing and publishing a new build, please provide the following details so we can engage the appropriate engineering teams for further analysis:

• Signing timestamp
• Intermediate CA assigned to the signing profile
• SHA-256 file hash of the affected binary

Reference Document: https://learn.microsoft.com/en-us/azure/artifact-signing/faq#what-can-i-expect-when-i-see-smartscreen-prompts-for-signed-files

We appreciate your patience while this issue was being investigated and resolved. Please let us know the outcome of your validation testing.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

You should not see the messages anymore.