Microsoft Azure Trusted Signing

Set up Azure Trusted Signing

To sign Windows builds with a Microsoft-issued certificate, Deskifier needs credentials from Azure Trusted Signing. This guide walks you through creating a signing account, verifying an identity, and generating the app credentials Deskifier uses to sign your builds.

1. Navigate to azure.microsoft.com/products/artifact-signing and click Get started with Azure.

2. After signing up or logging in, navigate to the Artifact Signing Accounts service in the Azure portal.

3. Click Create and enter a resource group name (recommended: <appName>Resource).

4. Select an account name & pricing plan (recommended: <appName>Account). Take note of the Account name — you'll enter it in the Deskifier dashboard as Azure Signing Account Name.

5. Once inside your new signing account, navigate to Access control (IAM) to set account permissions.

6. Search for "Artifact Signing Identity Verifier" and select it.

7. Select your user account under "Members".

8. Once you've selected the role and your account, click "Review + assign". Then go to "Overview" and click "Identity validation".

9. Click New identity → Public.

10. Enter all details as required.

11. Your identity is now pending verification. In the meantime, we can move on to the next step. Search for "Microsoft Entra ID".

12. Press Add → App registration.

13. Enter any name for your application.

14. Take note of these two values — you'll enter them into the Deskifier dashboard as Application Tenant ID & Application Client ID.

15. Head to "Certificates & secrets" and click "New client secret". Enter a description and click Add.

16. Take note of the Client secret value — you'll enter it as Application Client Secret.

17. Head back to the Artifact Signing service, into Access control (IAM), and click "Add" again.

18. Search "Artifact Signing Certificate Profile Signer" and select it.

19. Go to Select members, search your newly-created application, and assign it.

20. Head back to Overview and click Certificate profile. Take note of the account URI — you'll enter it as Azure Signing Endpoint.

21. Click Create → Public Trust.

22. Enter a Certificate Profile Name and select your identity. Take note of your Certificate Profile Name & Common Name — you'll enter them as Azure Certificate Profile Name & Azure Signing Publisher Name.

You should now have all the values Deskifier needs.

Where each value goes