After the setup in Azure, you enter six values, optionally seven, in the platform. The service principal needs the Artifact Signing Certificate Profile Signer role.
Values from the app registration
- In the Azure portal, open Microsoft Entra ID → App registrations and select the app registration for signing.
- Under Overview, copy the Directory (tenant) ID and the Application (client) ID.
- Go to Certificates & secrets → Client secrets. If you no longer have the value of the existing secret, create a new one with New client secret; Azure shows the Value only right after creation.
Values from the Artifact Signing account
- In the Azure portal, open the resource of type Artifact Signing (or Code Signing).
- Under Overview, copy the Name and the Endpoint. The endpoint follows the region of the account, for West Europe it is
https://weu.codesigning.azure.net; Microsoft’s Artifact Signing quickstart describes the resource. - Under Certificate profiles, note the name of the Public Trust profile.
The Subscription ID under Subscriptions is optional and only matters when the pipeline uses Azure login or OIDC with a subscription context.
Create the entry in the platform
Under Connections, create an Azure Artifact Signing entry:
| Platform field | Source |
|---|---|
| Tenant ID | Directory (tenant) ID of the app registration |
| Client ID | Application (client) ID of the same app registration |
| Client Secret | value of the client secret under Certificates & secrets |
| Signing Endpoint | endpoint of the Artifact Signing account, for example https://weu.codesigning.azure.net |
| Signing Account Name | name of the Artifact Signing account |
| Certificate Profile Name | name of the certificate profile in the account |
| Subscription ID | optional, from Subscriptions |
Click Verify credentials first; the entry can only be saved after a successful sign-in to Azure.
Enable signing in the project
Enable the Windows platform in the project and assign the Azure Artifact Signing entry. The pipeline then signs the Windows EXE and the installer before uploading them. For the Microsoft Store, additionally select the Microsoft Store account and enter the product ID as described under Microsoft Store credentials.
What the pipeline uses for signing
The pipeline signs with SignTool and the Azure Code Signing Dlib, not with AzureSignTool or Key Vault. The timestamp server is http://timestamp.acs.microsoft.com. SmartScreen reputation only builds up through downloads, so Windows may still show warnings for a freshly signed app at first.