Azure Trusted Signing

Azure Trusted Signing

Azure Trusted Signing is Microsoft's modern solution for code signing. It is a cloud-based service that eliminates many of the traditional pain points of code signing. Instead of managing hardware tokens, renewing certificates manually, and worrying about key security, you can integrate signing directly into your CI/CD pipeline and let Azure handle the rest.

The traditional approach to code signing required purchasing a certificate from a certificate authority, storing the private key on a hardware token, and using that token each time you needed to sign an application. This process was cumbersome, especially for automated build pipelines. Hardware tokens could fail, get lost, or need to be physically inserted into a machine for each signing operation.

Azure Trusted Signing solves these problems by keeping the signing keys in Microsoft's secure cloud infrastructure. You never have direct access to the private key. Instead, you authenticate to Azure using your identity, and Azure performs the signing operation on your behalf. This means no hardware tokens, no key management, and no manual steps. The signing happens automatically as part of your build process.

Setting up Azure Trusted Signing is straightforward. You create a signing resource in your Azure subscription, configure the signing policies, and then use the Azure Signing Tool or the built-in signing capabilities in your CI/CD pipeline. Azure Trusted Signing supports Authenticode signing for executables and DLLs, as well as MSIX and AppX package signing. It is quickly becoming the standard way to sign Windows applications, especially for teams using modern DevOps practices.