doppelt.digital Application Platform Documentation
English Deutsch

Azure Artifact Signing: setup

Create an Artifact Signing account, complete identity validation, and add a certificate profile in Azure.

On this page

Azure Artifact Signing (formerly Trusted Signing) is Microsoft’s cloud service for Authenticode signing of Windows EXEs and installers — no USB token. EU organizations are eligible for Public Trust.

Prerequisites

  • Azure subscription (Pay-as-you-go is enough)
  • Microsoft Entra ID tenant
  • Verifiable organization data for identity validation
  • Access to the Azure portal with rights to create resources and assign roles

1. Resource provider and account

  1. In the Azure portal open Subscriptions → select your subscription → Resource providers.
  2. Find Microsoft.CodeSigning and click Register (if not already registered).
  3. Create a new Artifact Signing (or Code Signing) resource — choose a region, e.g. West Europe.
  4. After creation, open the resource and under Overview note:
    • Account name (resource name)
    • Endpoint (regional URI, e.g. https://weu.codesigning.azure.net)

Quickstart: Set up Artifact Signing.

2. Identity validation

  1. Assign yourself the Artifact Signing Identity Verifier role on the Artifact Signing account (or via IAM).
  2. Start identity validation in the account and submit organization data (may take several business days).
  3. For EU companies, a VAT / Tax ID often works better than DUNS; company name and address must match public records exactly.

Without completed validation you cannot create a Public Trust certificate profile.

3. Certificate profile

  1. After successful validation, under Certificate profiles in the Artifact Signing account create a Public Trust profile.
  2. Note the certificate profile name — you will need it later in the Application Platform.

4. Service principal for CI

  1. Azure portal → Microsoft Entra ID → App registrations → New registration.
  2. Choose a clear name (e.g. application-platform-artifact-signing).
  3. Under Certificates & secrets → New client secret, create a secret and store the value securely.
  4. Assign the Artifact Signing Certificate Profile Signer role to the service principal (enterprise application for the app registration) — scope: the whole Artifact Signing account or only the certificate profile.

Roles: Artifact Signing roles.

Next step

Enter tenant ID, client ID, secret, endpoint, account name, and certificate profile in the Application Platform: Azure Artifact Signing: credentials.