Merge pull request #276538 from mehasharma/faq-vetting

add changes to faq

Author: ttorble

articles/trusted-signing/TOC.yml

@@ -22,6 +22,8 @@
       href: how-to-cert-revocation.md
     - name: Renew Trusted Signing identity validation
       href: how-to-renew-identity-validation.md
+    - name: Change Pricing Tier
+      href: how-to-change-sku.md
   - name: Tutorials
     items:
     - name: Assign roles in Trusted Signing

articles/trusted-signing/faq.yml

@@ -38,7 +38,8 @@ sections:
 
       - question: What if I fail identity validation?
         answer: | 
-          - Ensure you did not miss an email verification link sent to the primary email address shared during Identity Validation request creation. The link expires in 7 days, so you need to create a new Identity Validation request.   
+          - Organizations with a year founded date, less than 3 years cannot be onboarded at the moment and will fail Identity Validation. 
+          - For Organizations, with year founded date more than 3 years: Ensure you did not miss an email verification link sent to the primary email address shared during Identity Validation request creation. The link expires in 7 days, so you need to create a new Identity Validation request.   
           - If the failure is not to due to missed email verification; then the Microsoft validation team wasn't able to make a determination about your request based on the information that you provided (even after you provided more documentation when we request it), we can't onboard you to Trusted Signing. In this scenario, we recommend that you delete your Trusted Signing account so that you aren't billed for unused resources.
       - question: What if I need assistance with Identity Validation?
         answer: | 
@@ -70,6 +71,7 @@ sections:
       - question: What do I do if my identity validation expired?
         answer: |
           Failure to renew identity validation before the expiration date stops certificate renewal, effectively halting the signing process associated with those specific certificate profiles. To continue signing by using the Trusted Signing service, you need to create another identity validation and associate it with the certificate profiles. 
+       
   - name: Signing
     questions:
       - question: What types of files can be signed with Trusted Signing?
@@ -156,7 +158,13 @@ sections:
           | Error code (-2147024885/0x8007000b)            |  For MSIX signing, indicates that the publisher in the manifest file doesn't match the certificate subject. Check the publisher that's listed in the manifest file. |
           | No error codes, SignTool silently fails          |  Ensure that the relevant .NET runtime version is installed. |
           | Azure.Identity.CredentialUnavailableException         |  You might see this error in [environments outside Azure](https://github.com/Azure/azure-sdk-for-net/issues/29471). If you are working outside of Azure, we recommend that you add "exclude ManagedIdentity". |
-  
+  - name: Cost Management and Billing
+    questions:  
+       - question: How do I view usage costs and billing information for Trusted Signing resources?
+         answer: | 
+          Review resource usage costs under your selected Subscription > Cost Management and for further details follow [Cost Management](https://learn.microsoft.com/azure/cost-management-billing/costs/).
+          Review billing information under your selected Subscription > Billing and for further details follow [Billing](https://learn.microsoft.com/azure/cost-management-billing/manage/).
+
   - name: Unenroll from the Trusted Signing service
     questions:  
        - question: How do I unenroll from Trusted Signing?

articles/trusted-signing/how-to-change-sku.md

@@ -0,0 +1,79 @@
+---
+title: Change SKU selection 
+description: How-to change your SKU for Trusted Signing account. 
+author: mehasharma 
+ms.author: mesharm 
+ms.service: trusted-signing 
+ms.topic: how-to 
+ms.date: 05/30/2024 
+---
+
+
+# Select or change Trusted Signing SKU (Pricing tier)
+
+Trusted Signing provides a choice between two pricing tiers: Basic and Premium. Both tiers are tailored to offer the service at an optimal cost, suitable for any signing scenario.  
+
+## SKU (Pricing tier) overview
+
+Each pricing tier provides varying options for the number of certificate profile types available and the monthly allocation of signatures. 
+
+|        Subscription level       | Basic  | Premium     |
+| :------------------- | :------------------- |:---------------|
+| Price(monthly)              | **$9.99 / account**              | **$99.99 / account**  |
+| Quota (signatures / month)             | 5,000              | 100,000  |
+| Price after quota is reached             | $0.005 / signature               | $0.005 / signature   |
+| Certificate Profiles             | 1 of each available type               | 10 of each available type  |
+| Public-Trust Signing             | Yes               | Yes  |
+| Private-Trust Signing             | Yes               | Yes  |
+                        
+**Note**: The pricing tier is also referred to as the SKU.
+
+
+## Change SKU
+
+You can change the SKU for a Trusted Signing account at any time by upgrading to Premium or downgrading to Basic. This change can be done from both the Azure portal and from Azure CLI. 
+
+- SKU updates are effective from next billing cycle.
+- SKU limitations for updated SKU are enforced after the update is successful.
+- Downgrade to Basic: 
+    - The Basic SKU allows only one certificate profile of each type. For example, if you have two certificate profiles of type Public Trust, you need to delete any one profile to be eligible to downgrade. Same applies for other certificate profile types as well.
+- Upgrade to Premium:  
+    - There are no limitations when you upgrade to the Premium SKU from Basic SKU. 
+- After changing the SKU, you're required to manually refresh the Account Overview section to see the updated SKU under SKU (Pricing tier). (This limitation is known, and being actively worked on to resolve). 
+
+# [Azure portal](#tab/sku-portal)
+
+To change the SKU (Pricing tier) from the Azure portal, follow these steps:
+
+1. Sign in to the Azure portal.
+2. Navigate to your Trusting Signing account in the Azure portal.
+3. On the account Overview page, locate the current **SKU (Pricing tier)**. 
+4. Select the current SKU selection hyperlink. Your current selection is highlighted in the "choose pricing tier" window.
+5. Select the SKU you want to update to (for example, downgrade to Basic or upgrade to Premium) and select **Update**. 
+
+ 
+# [Azure CLI](#tab/sku-cli)
+
+To change the SKU with Azure CLI, use the following command: 
+
+```
+az trustedsigning update -n MyAccount -g MyResourceGroup --sku Premium
+```
+---
+
+## Cost Management and Billing
+
+**Cost Management**
+
+View and estimate the cost of your Trusted Signing resource usage.  
+1. In the Azure portal, search **Subscriptions**.
+2. Select the **Subscription**, where you have created Trusted Signing resources.
+3. Select Cost Management from the menu on the left. Learn more about using [Cost Management](https://learn.microsoft.com/azure/cost-management-billing/costs/).
+4. For Trusted Signing, you can see costs associated to your Trusted Signing account.  
+
+**Billing**
+
+View Invoice for Trusted Signing service. 
+1. In the Azure portal, search **Subscriptions**.
+2. Select the **Subscription**, where you have created Trusted Signing resources.
+3. Select Billing from the menu on the left. Learn more about [Billing](https://learn.microsoft.com/azure/cost-management-billing/manage/).