This guide explains where the values for Store accounts → Azure Artifact Signing come from and how to enter them. The platform validates authentication before saving.
Prerequisites
- Completed setup: Azure Artifact Signing: setup
- Service principal with role Artifact Signing Certificate Profile Signer
1. Collect values from Azure and Entra
Tenant ID and Client ID
- Open the Azure portal → Microsoft Entra ID → App registrations.
- Open the app registration you created for signing (signer service principal).
- Under Overview, note:
- Directory (tenant) ID → Tenant ID field
- Application (client) ID → Client ID field
Client Secret
- In the same app registration: Certificates & secrets → Client secrets → New client secret.
- Copy the Value immediately — Azure shows it only once.
- Enter it as Client Secret.
Signing Endpoint and Signing Account Name
- In the Azure portal, open the Artifact Signing account (Artifact Signing / Code Signing resource).
- Under Overview, note:
- Account Name → Signing Account Name field
- Endpoint / regional URI (e.g.
https://weu.codesigning.azure.net) → Signing Endpoint field
If the endpoint is not shown directly: it follows the account region (West Europe → https://weu.codesigning.azure.net). See also Set up Artifact Signing.
Certificate Profile Name
- In the Artifact Signing account, open Certificate profiles.
- Note the Public Trust profile name → Certificate Profile Name field.
Subscription ID (optional)
- Azure portal → Subscriptions → open the relevant subscription.
- Copy the Subscription ID.
This field is optional. The platform does not require it for credential validation; it can matter when the pipeline uses Azure login / OIDC with a subscription context.
2. Enter values in the Application Platform
Under Store accounts, create an Azure Artifact Signing entry:
| Field in the platform | Source |
|---|---|
| Tenant ID | Directory (tenant) ID of the Entra app registration (Overview) |
| Client ID | Application (client) ID of the same app registration (Overview) |
| Client Secret | Client secret value under Certificates & secrets |
| Signing Endpoint | Endpoint of the Artifact Signing account (e.g. https://weu.codesigning.azure.net) |
| Signing Account Name | Name of the Artifact Signing account (Overview) |
| Certificate Profile Name | Certificate profile name in the account |
| Subscription ID | optional — Subscription ID under Subscriptions |
Click Verify credentials first. Only then can you save.
3. Use in a project
- Enable the Windows platform on the project.
- Assign Azure Artifact Signing — CI then signs the Windows EXE and installer before upload.
- For Microsoft Store publish, also set the Microsoft Store account and product ID (signing remains required).
Important notes
- Do not use AzureSignTool / Key Vault for Artifact Signing — the pipeline uses SignTool + Azure Code Signing Dlib.
- Timestamp server:
http://timestamp.acs.microsoft.com. - SmartScreen reputation builds over downloads; early warnings are expected.