# Azure Artifact Signing: credentials

The platform signs Windows builds with your service principal and certificate profile from Azure, whose values you store once for the organization.

> Source: https://www.application-platform.com/en/docs/azure-artifact-signing-credentials/

After the [setup in Azure]({{< relref "azure-artifact-signing-setup" >}}), you enter six values, optionally seven, in the platform. The service principal needs the **Artifact Signing Certificate Profile Signer** role.

## Values from the app registration

1. In the [Azure portal](https://portal.azure.com/), open **Microsoft Entra ID** → **App registrations** and select the app registration for signing.
2. Under **Overview**, copy the **Directory (tenant) ID** and the **Application (client) ID**.
3. Go to **Certificates & secrets** → **Client secrets**. If you no longer have the value of the existing secret, create a new one with **New client secret**; Azure shows the **Value** only right after creation.

## Values from the Artifact Signing account

1. In the Azure portal, open the resource of type Artifact Signing (or Code Signing).
2. Under **Overview**, copy the **Name** and the **Endpoint**. The endpoint follows the region of the account, for West Europe it is `https://weu.codesigning.azure.net`; Microsoft's [Artifact Signing quickstart](https://learn.microsoft.com/azure/artifact-signing/quickstart) describes the resource.
3. Under **Certificate profiles**, note the name of the Public Trust profile.

The **Subscription ID** under **Subscriptions** is optional and only matters when the pipeline uses Azure login or OIDC with a subscription context.

## Create the entry in the platform

Under **Connections**, create an **Azure Artifact Signing** entry:

| Platform field | Source |
|---|---|
| Tenant ID | Directory (tenant) ID of the app registration |
| Client ID | Application (client) ID of the same app registration |
| Client Secret | value of the client secret under Certificates & secrets |
| Signing Endpoint | endpoint of the Artifact Signing account, for example `https://weu.codesigning.azure.net` |
| Signing Account Name | name of the Artifact Signing account |
| Certificate Profile Name | name of the certificate profile in the account |
| Subscription ID | optional, from **Subscriptions** |

Click **Verify credentials** first; the entry can only be saved after a successful sign-in to Azure.

## Enable signing in the project

Enable the Windows platform in the project and assign the **Azure Artifact Signing** entry. The pipeline then signs the Windows EXE and the installer before uploading them. For the Microsoft Store, additionally select the Microsoft Store account and enter the product ID as described under [Microsoft Store credentials]({{< relref "microsoft-store-credentials" >}}).

## What the pipeline uses for signing

The pipeline signs with SignTool and the Azure Code Signing Dlib, not with AzureSignTool or Key Vault. The timestamp server is `http://timestamp.acs.microsoft.com`. SmartScreen reputation only builds up through downloads, so Windows may still show warnings for a freshly signed app at first.