Azure Artifact Signing: setup

Azure Artifact Signing, formerly Trusted Signing, is Microsoft’s cloud service for Authenticode signing of Windows programs and installers. Organizations from the EU, such as a German GmbH, are eligible for certificates with Public Trust.

You need an Azure subscription (Pay-as-you-go is enough), a Microsoft Entra ID tenant, verifiable organization data, and access to the Azure portal with rights to create resources and assign roles.

Register the resource provider and create the account

1. In the Azure portal, open Subscriptions, select your subscription, and then Resource providers.
2. Find the provider Microsoft.CodeSigning and click Register if it is not registered yet.
3. Create a new resource of type Artifact Signing (Code Signing in older interfaces) and choose a region, for example West Europe.
4. Under Overview, note the Account name and the Endpoint, for example https://weu.codesigning.azure.net.

Microsoft describes these steps in the Artifact Signing quickstart.

Verify the identity of your organization

1. Assign yourself the Artifact Signing Identity Verifier role on the Artifact Signing account (or via IAM).
2. Start the Identity Validation in the account and submit the data of your organization. The check can take several business days.
3. Companies from the EU often provide the VAT ID or Tax ID instead of a DUNS number. Company name and address must match the public registers exactly, otherwise the check fails.

Create the certificate profile

1. After successful validation, go to Certificate profiles in the Artifact Signing account and create a profile of type Public Trust.
2. Note the certificate profile name.

Service principal for the pipeline

1. In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
2. Give it a descriptive name such as application-platform-artifact-signing.
3. Under Certificates & secrets → New client secret, create a secret and store the Value directly after creating it.
4. Assign the Artifact Signing Certificate Profile Signer role to the service principal, that is, the enterprise application of the app registration. As scope, choose the certificate profile or the whole account.

Microsoft describes the available roles under Artifact Signing roles.

You then enter the noted values and the secret in the platform under Azure Artifact Signing credentials.