# Azure Artifact Signing: setup

How to create an Artifact Signing account in Azure, get your organization verified, and set up the certificate profile and service principal for the pipeline.

> Source: https://www.application-platform.com/en/docs/azure-artifact-signing-setup/

**Azure Artifact Signing**, formerly Trusted Signing, is Microsoft's cloud service for Authenticode signing of Windows programs and installers. Organizations from the EU, such as a German GmbH, are eligible for certificates with Public Trust.

You need an Azure subscription (Pay-as-you-go is enough), a Microsoft Entra ID tenant, verifiable organization data, and access to the [Azure portal](https://portal.azure.com/) with rights to create resources and assign roles.

## Register the resource provider and create the account

1. In the Azure portal, open **Subscriptions**, select your subscription, and then **Resource providers**.
2. Find the provider **`Microsoft.CodeSigning`** and click **Register** if it is not registered yet.
3. Create a new resource of type **Artifact Signing** (Code Signing in older interfaces) and choose a region, for example **West Europe**.
4. Under **Overview**, note the **Account name** and the **Endpoint**, for example `https://weu.codesigning.azure.net`.

Microsoft describes these steps in the [Artifact Signing quickstart](https://learn.microsoft.com/azure/artifact-signing/quickstart).

## Verify the identity of your organization

1. Assign yourself the **Artifact Signing Identity Verifier** role on the Artifact Signing account (or via IAM).
2. Start the **Identity Validation** in the account and submit the data of your organization. The check can take several business days.
3. Companies from the EU often provide the **VAT ID or Tax ID** instead of a DUNS number. Company name and address must match the public registers exactly, otherwise the check fails.

## Create the certificate profile

1. After successful validation, go to **Certificate profiles** in the Artifact Signing account and create a profile of type **Public Trust**.
2. Note the **certificate profile name**.

## Service principal for the pipeline

1. In the Azure portal, open **Microsoft Entra ID** → **App registrations** → **New registration**.
2. Give it a descriptive name such as `application-platform-artifact-signing`.
3. Under **Certificates & secrets** → **New client secret**, create a secret and store the **Value** directly after creating it.
4. Assign the **Artifact Signing Certificate Profile Signer** role to the service principal, that is, the enterprise application of the app registration. As scope, choose the certificate profile or the whole account.

Microsoft describes the available roles under [Artifact Signing roles](https://learn.microsoft.com/azure/artifact-signing/tutorial-assign-roles).

You then enter the noted values and the secret in the platform under [Azure Artifact Signing credentials]({{< relref "azure-artifact-signing-credentials" >}}).