{"id":4639,"date":"2026-01-06T09:53:55","date_gmt":"2026-01-06T09:53:55","guid":{"rendered":"https:\/\/signmycode.com\/resources\/?p=4639"},"modified":"2026-01-06T09:53:58","modified_gmt":"2026-01-06T09:53:58","slug":"how-to-set-up-azure-trusted-signing-to-sign-an-exe","status":"publish","type":"post","link":"https:\/\/signmycode.com\/resources\/how-to-set-up-azure-trusted-signing-to-sign-an-exe","title":{"rendered":"How to Set Up Azure Trusted Signing to Sign an EXE?"},"content":{"rendered":"\n

Introduction<\/h2>\n\n\n\n

Code signing is no longer an optional process – Windows, antivirus engines, and enterprise security tools all expect executables to be digitally signed. Previously, developers purchased an EV Code Signing Certificate<\/a>, stored it on a USB token or HSM, and had to maintain it for years.<\/p>\n\n\n\n

Azure Trusted Signing reimagines the process with cloud-based certificate issuance, short-lived certificates, automated identity verification, and fully integrated CI\/CD workflows<\/a>.<\/p>\n\n\n\n

This overview discusses what Azure Trusted Signing is, why developers would use it, other options, costs, prerequisites, and a complete step-by-step setup – from setting up your account to signing your first EXE.<\/p>\n\n\n\n

What is Azure Trusted Signing?<\/h2>\n\n\n\n

Azure Trusted Signing is Microsoft’s cloud-based code signing service to help developers sign executables, installers, scripts, and applications securely without managing long-term private keys.<\/p>\n\n\n\n

Instead of the typical certificate files stored on a local machine, Azure Trusted Signing issues short-lived certificates as needed, reducing the risk of private keys being stolen and simplifying the certificate lifecycle management.<\/p>\n\n\n\n

Recommended:<\/strong> Code Signing Certificate Validity Changes: A New Era of Trust and Automation<\/a><\/p>\n\n\n\n

Azure Trusted Signing works directly with Azure Active Directory, giving you centralized identity-driven access controls, as well as the ability to support automated DevOps pipelines<\/a> through the use of CLI and API tools.<\/p>\n\n\n\n

This service is especially valuable for organizations that need scalable, compliant, and tamper-evident signing workflows.<\/p>\n\n\n\n

Features such as identity validation, role-based access control<\/a>, audit logging, and integration with Azure Key Vault and CI\/CD tooling give Azure Trusted Signing a modern, secure model, replacing the era of storing private keys on developers\u2019 machines.<\/p>\n\n\n\n

Ultimately, the service ensures the published software is trusted by Windows and the rest of the large operating system ecosystems, reducing operational burden and risk to security and compliance.<\/p>\n\n\n\n

Alternatives to Azure Trusted Signing<\/h2>\n\n\n\n

An alternative for Azure Trusted Signing is the option of buying a DigiCert code signing certificate<\/a> and storing its private key securely in Azure Key Vault. Or we offer an Azure Key Vault Code Signing Certificate<\/a> from DigiCert; you can directly purchase that.<\/p>\n\n\n\n

By doing so, you have full control over your certificate, while simultaneously leveraging the HSM-backed security offered by Azure Key Vault.<\/p>\n\n\n\n

Recommended:<\/strong> Managed HSM Vs. Azure Vault Key Difference<\/a><\/p>\n\n\n\n

You can use the key as part of your CI\/CD pipelines, enforce key access policies, and autonomously sign workloads. With this alternative, you have strong security, flexible implementation, and freedom from the managed signing service by Azure.<\/p>\n\n\n\n

Recommended:<\/strong> How to Create Key Vault, CSR, and Import Code Signing Certificate in Azure KeyVault HSM?<\/a><\/p>\n\n\n\n

Quickstart: What you\u2019ll need<\/h2>\n\n\n\n

Before you begin, you need the following:<\/p>\n\n\n\n

A Trusted Signing Account<\/h3>\n\n\n\n

Before you start, you need to create a Trusted Signing account from the Azure Portal<\/a>. This account is the basis of your signing environment, and it identifies where your certificate profiles, policies, and permissions will exist.<\/p>\n\n\n\n

You cannot generate or use Azure’s short-lived code signing certificates without first having this account.<\/p>\n\n\n\n

Identity Validation<\/h3>\n\n\n\n

After this, Microsoft requires you to go through identity validation to ensure that your signatures will be publicly trusted.<\/p>\n\n\n\n

You can validate for yourself, as an Individual, which is for the personal developer, or as an Organization which is strongly suggested for businesses, enterprises, and development teams. Validating either way allows Azure to issue trusted short-lived certificates on your behalf.<\/p>\n\n\n\n

A Certificate Profile<\/h3>\n\n\n\n

Next, you must create a certificate profile, which is the template Azure will use to create your short-lived code signing certificates automatically. The profile defines the type of certificate, the usage policies for the certificate, and the signing algorithms in use.<\/p>\n\n\n\n

On each signing action, Azure will create a new secure time-limited code signing certificate based on this profile that you can use to sign the EXE.<\/p>\n\n\n\n

Required IAM Roles<\/h3>\n\n\n\n

To be able to perform signing actions, your Azure identity is required to have the appropriate IAM roles assigned.<\/p>\n\n\n\n

At a minimum, two roles need to be assigned: <\/strong>the Trusted Signing Identity Verifier, which verifies that you can act on behalf of the signing account, and the Trusted Signing Certificate Profile Signer, which allows your identity to request signing certificates from the certificate profile. <\/p>\n\n\n\n

If the required roles are not assigned, your signing actions will fail because you lack the proper permission scope.<\/p>\n\n\n\n

Supported Operating Systems<\/h3>\n\n\n\n

Finally, you will need to have the signing tools running on a supported operating system, as Azure Trusted Signing tools only run in modern environments.<\/p>\n\n\n\n

As it currently stands, the supported operating systems are functioning on Windows 10 version 1809 or later, Windows 11, and any version of Windows Server 2016 or newer.<\/p>\n\n\n\n

If the tools are run on unsupported operating systems, then the tools may not work as expected, or the signing process may be entirely blocked.<\/p>\n\n\n\n

Pricing & Eligibility<\/h2>\n\n\n\n
Model Type<\/strong><\/td>Basic<\/strong><\/td>Premium<\/strong><\/td><\/tr>
Base price (monthly)<\/td>$9.99<\/td>$99.99<\/td><\/tr>
Quota (signatures\/month)<\/td>5,000<\/td>100,000<\/td><\/tr>
Price after quota is reached<\/td>$0.005\/signature<\/td>$0.005\/signature<\/td><\/tr>
Includes<\/td>Public\/Private Signing 1 of each Certificate Profile type<\/td>Public\/Private Signing 10 of each Certificate Profile type<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Step-by-Step Guide: Setting Up Azure Trusted Signing<\/h2>\n\n\n\n

Below is how to set everything up, based on the information from Microsoft’s official documentation and the technical workflows we reviewed and analyzed above.<\/p>\n\n\n\n

<\/a>Step 1: Create an Azure Account & Subscription<\/h3>\n\n\n\n