Co-authored with @bibingeorgedev
This article documents a practical implementation we worked on together.

A note before you begin: I originally put this article together around two years ago but never got around to publishing it. Some Azure Trusted Signing features, requirements, portal steps, and eligibility rules may have changed since then. I'm sharing the original notes because they may still be useful, but please verify the current details against [Microsoft's official Trusted Signing documentation]
https://learn.microsoft.com/en-us/azure/trusted-signing/.

How to code sign a Tauri application with Microsoft Azure Trusted Signing, without any additional EV/OV certificates.

• Trusted Signing (formerly Azure Code Signing) is a fully managed service that facilitates app signing for developers. The service provides assurances of authenticity and integrity in applications, which enhances security features that prevent and mitigate malware impacts on the Windows OS.
• A Trusted Signing signature ensures that your application is trusted by providing base reputation on smart screen, user mode trust on Windows, and integrity check signature validation compliant.
• Trusted Signing currently supports public trust, private trust, and test trust signing.
• “Trusted Signing at this time can only onboard Legal Business Entities that have verifiable tax history of three or more years.”

Set up Trusted Signing

Trusted Signing is a Microsoft fully managed, end-to-end certificate signing service. In this quickstart, you create the following three Trusted Signing resources to begin using Trusted Signing:

• A Trusted Signing account
• An identity validation
• A certificate profile

You can use either the Azure portal or an Azure CLI extension to create and manage most of your Trusted Signing resources. (You can complete identity validation only in the Azure portal. You can't complete identity validation by using the Azure CLI.) This quickstart shows you how.

Prerequisites

• A Microsoft Entra tenant ID.

  To create a new tenant

1. Sign in to the Azure portal.
2. From the Azure portal menu, select **Microsoft Entra ID**.
3. Navigate to **Identity** > **Overview** > **Manage tenants**.
4. Select **Create**.

(https://learn.microsoft.com/en-us/entra/includes/definitions/media/create-new-tenant/portal.png)]

5. On the Basics tab, select the type of tenant you want to create, either Microsoft Entra ID or Microsoft Entra ID (B2C).
6. Select Next: Configuration to move to the Configuration tab.
7. On the Configuration tab, enter the following information:

    (https://learn.microsoft.com/en-us/entra/includes/definitions/media/create-new-tenant/create-new-tenant.png)

    - Type your desired Organization name (for example *Contoso Organization*) into the **Organization name** box.
    - Type your desired Initial domain name (for example *Contosoorg*) into the **Initial domain name** box.
    - Select your desired Country/Region or leave the *United States* option in the **Country or region** box.
8. Select **Next: Review + Create**. Review the information you entered and if the information is correct, select **Create** in the lower left corner.

Your new tenant is created with the domain contoso.onmicrosoft.com.

**Your user account in the new tenant**

When you create a new Microsoft Entra tenant, you become the first user of that tenant. As the first user, you're automatically assigned the Global Administrator role. Review your user account by navigating to the **Users** page.

By default, you're also listed as the technical contact for the tenant. Technical contact information is something you can change in **Properties**.

Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role. These accounts are highly privileged and aren't assigned to specific individuals. The accounts are limited to emergency or "break glass" scenarios where normal accounts can't be used or all other administrators are accidentally locked out. These accounts should be created following the emergency access account recommendations.

**Clean up resources**

If you're not going to continue to use this application, you can delete the tenant using the following steps:

- Ensure that you're signed in to the directory that you want to delete through the **Directory + subscription** filter in the Azure portal. Switch to the target directory if needed.
- Select **Microsoft Entra ID**, and then on the **Contoso - Overview** page, select **Delete directory**.

    The tenant and its associated information are deleted.

    (https://learn.microsoft.com/en-us/entra/fundamentals/media/create-new-tenant/delete-new-tenant.png)

• An Azure subscription.

  Create a subscription

  Use the following procedure to create a subscription for yourself or for someone in the current Microsoft Entra ID. When you're done, the new subscription is created immediately.

1. Sign in to the Azure portal.
2. Navigate to **Subscriptions** and then select **Add**.

    (https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/subscription-add.png)

3. On the Create a subscription page, on the **Basics** tab, type a **Subscription name**.
4. Select the **Billing account** where the new subscription gets created.
5. Select the **Billing profile** where the subscription gets created.
6. Select the **Invoice section** where the subscription gets created.
7. Next to **Plan**, select **Microsoft Azure Plan for DevTest** if the subscription is used for development or testing workloads. Otherwise, select **Microsoft Azure Plan**.

    (https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/create-subscription-basics-tab.png)

8. Select the **Advanced** tab.
9. Select your **Subscription directory**. It's the Microsoft Entra ID where the new subscription gets created.
10. Select a **Management group**. It's the Microsoft Entra management group that the new subscription is associated with. You can only select management groups in the current directory.
11. Select one or more **Subscription owners**. You can select only users or service principals in the selected subscription directory. You can't select guest directory users. If you select a service principal, enter its App ID.

    (https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/create-subscription-advanced-tab.png)

12. Select the **Tags** tab.
13. Enter tag pairs for **Name** and **Value**.

    (https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/create-subscription-tags-tab.png)

14. Select **Review + create**. You should see a message stating `Validation passed`.
15. Verify that the subscription information is correct, then select **Create**. A notification that the subscription is getting created is shown.

After the new subscription is created, the owner of the subscription can see it in on the **Subscriptions** page.

**View the new subscription**

When you created the subscription, Azure created a notification stating **Successfully created the subscription**. The notification also had a link to **Go to subscription**, which allows you to view the new subscription. If you missed the notification, you can view select the bell symbol in the upper-right corner of the portal to view the notification that has the link to **Go to subscription**. Select the link to view the new subscription.

Here's an example of the notification:

(https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/subscription-create-notification.png)

Or, if you're already on the Subscriptions page, you can refresh your browser's view to see the new subscription.

**View all subscriptions**

If you created a subscription but can't find it in the Subscriptions list view, a view filter might be applied.

To clear the filter and view all subscriptions:

1. In the Azure portal, navigate to **Subscriptions**.
2. At the top of the list, select the Subscriptions filter item.
3. At the top of the subscriptions filter box, select **All**. At the bottom of the subscriptions filter box, clear **Show only subscriptions selected in the global subscriptions filter**.

    (https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/media/create-subscription/subscriptions-filter-item.png)

4. Select **Apply** to close the box and refresh the list of subscriptions.

Register the Trusted Signing resource provider

Before you use Trusted Signing, you must register the Trusted Signing resource provider.

A resource provider is a service that supplies Azure resources. Use the Azure portal or the Azure CLI to register the Microsoft.CodeSigning Trusted Signing resource provider.

• Azure portal
• Azure CLI

To register a Trusted Signing resource provider by using the Azure portal:

1. Sign in to the Azure portal.
2. In either the search box or under All services, select Subscriptions.
3. Select the subscription where you want to create Trusted Signing resources.
4. On the resource menu under Settings, select Resource providers.

5. In the list of resource providers, select Microsoft.CodeSigning.

   By default, the resource provider status is NotRegistered.

   (https://learn.microsoft.com/en-us/azure/trusted-signing/media/trusted-signing-resource-provider-registration.png)

6. Select the ellipsis, and then select Register.

   (https://learn.microsoft.com/en-us/azure/trusted-signing/media/trusted-signing-resource-provider.png)

   The status of the resource provider changes to Registered.

Create a Trusted Signing account

A Trusted Signing account is a logical container that holds identity validation and certificate profile resources.

Naming constraints for Trusted Signing accounts

Trusted Signing account names have some constraints.

A Trusted Signing account name must:

• Contain from 3 to 24 alphanumeric characters.
• Be globally unique.
• Begin with a letter.
• End with a letter or number.
• Not contain consecutive hyphens.

A Trusted Signing account name is:

• Not case-sensitive (ABC is the same as abc).
• Rejected by Azure Resource Manager if it begins with "one".
• Azure portal
• Azure CLI

To create a Trusted Signing account by using the Azure portal:

1. Sign in to the Azure portal.

2. Search for and then select Trusted Signing Accounts.

   (https://learn.microsoft.com/en-us/azure/trusted-signing/media/trusted-signing-search-service.png)

3. On the Trusted Signing Accounts pane, select Create.

4. For Subscription, select your Azure subscription.

5. For Resource group, select Create new, and then enter a resource group name.

6. For Account name, enter a unique account name.

   For more information, see Naming constraints for Trusted Signing accounts.

7. For Region, select an Azure region that supports Trusted Signing.

8. For Pricing, select a pricing tier.

9. Select the Review + Create button.

   (https://learn.microsoft.com/en-us/azure/trusted-signing/media/trusted-signing-account-creation.png)

10. After you successfully create your Trusted Signing account, select Go to resource.

Create an identity validation request

You can complete your own identity validation by filling in the request form with the information that must be included in the certificate. Identity validation can be completed only in the Azure portal. You can't complete identity validation by using the Azure CLI.

Note

You can't create an identity validation request if you aren't assigned the appropriate role. If the New identity button on the menu bar appears dimmed in the Azure portal, ensure that you are assigned the Trusted Signing Identity Verifier roler to proceed with identity validation.

• Identity Validation - Organization
• Identity Validation - Individual Developer

To create an identity validation request for an Organization:

1. In the Azure portal, go to your new Trusted Signing account.

2. Confirm that you're assigned the Trusted Signing Identity Verifier role.

   To learn how to manage, access by using role-based access control (RBAC), see Tutorial: Assign roles in Trusted Signing.

3. On the Trusted Signing account Overview pane or on the resource menu under Objects, select Identity validations.

4. Select New identity, and then select either Public or Private.

   • Public identity validation applies only to these certificate profile types: Public Trust, Public Trust Test, VBS Enclave.
   • Private identity validation applies only to these certificate profile types: Private Trust, Private Trust CI Policy.

5. On New identity validation, provide the following information:

   Expand table

   Fields	Details
   Organization Name	For public identity validation, provide the legal business entity to which the certificate is issued. For private identity validation, the value defaults to your Microsoft Entra tenant name.
   (Private Identity Type only) Organizational Unit	Enter the relevant information.
   Website url	Enter the website that belongs to the legal business entity.
   Primary Email	Enter the email address associated with the legal business entity undergoing validation. Part of the Identity Validation process, a verification link is sent to this email address and the link expires in seven days. Ensure that the email address can receive emails(with links) from external email addresses.
   Secondary Email	This email address must be different from the primary email address. For organizations, the domain must match the email address that is provided in the primary email address. Ensure that the email address can receive emails from external email addresses that have links.
   Business Identifier	Enter a business identifier for the legal business entity.
   Seller ID	Applies only to Microsoft Store customers. Find your Seller ID in the Partner Center portal.
   Street, City, Country, State, Postal code	Enter the business address of the legal business entity.

6. Select Certificate subject preview to see the preview of the information that appears in the certificate.

7. Select I accept Microsoft terms of use for trusted signing services. You can download the Terms of Use to review or save them.

8. Select the Create button.

9. When the request is successfully created, the identity validation request status changes to In Progress.

10. If more documents are required, an email is sent and the request status changes to Action Required.

11. When the identity validation process is finished, the request status changes, and an email is sent with the updated status of the request:

12. Completed if the process is completed successfully.

13. Failed if the process isn't completed successfully.

Important information for public identity validation

Expand table

Create a certificate profile

A certificate profile resource is the logical container of the certificates that are issued to you for signing.

Naming constraints for certificate profiles

Certificate profile names have some constraints.

A certificate profile name must:

• Contain from 5 to 100 alphanumeric characters.
• Begin with a letter, end with a letter or number, and not contain consecutive hyphens.
• Be unique within the account.

A certificate profile name is:

• In the same Azure region as the account, by default inheritance.
• Not case-sensitive (ABC is the same as abc).
• Azure portal
• Azure CLI

To create a certificate profile in the Azure portal:

1. In the Azure portal, go to your new Trusted Signing account.
2. On the Trusted Signing account Overview pane or on the resource menu under Objects, select Certificate profiles.

3. On the command bar, select Create and select a certificate profile type.

   

4. On Create certificate profile, provide the following information:

   a. For Certificate Profile Name, enter a unique name.

   For more information, see Naming constraints for certificate profiles.

   The value for Certificate Type is autopopulated based on the certificate profile type you selected.

   b. For Verified CN and O, select an identity validation that must be displayed on the certificate.

- If the street address must be displayed on the certificate, select the **Include street address** checkbox.
- If the postal code must be displayed on the certificate, select the **Include postal code** checkbox.

    The values for the remaining fields are autopopulated based on your selection for **Verified CN and O**.

    A generated **Certificate Subject Preview** shows the preview of the certificate that will be issued.

1. Select Create.

   

Clean up resources

• Azure portal
• Azure CLI

To delete Trusted Signing resources by using the Azure portal:

Delete a certificate profile

1. In the Azure portal, go to your Trusted Signing account.
2. On the Trusted Signing account Overview pane or on the resource menu under Objects, select Certificate profiles.
3. On Certificate profiles, select the certificate profile that you want to delete.
4. On the command bar, select Delete.

Note

This action stops any signing that's associated with the certificate profile.

Delete a Trusted Signing account

1. Sign in to the Azure portal.
2. In the search box, enter and then select Trusted Signing Accounts.
3. On Trusted Signing Accounts, select the Trusted Signing account that you want to delete.
4. On the command bar, select Delete.

Note

This action removes all certificate profiles that are linked to this account. Any signing processes that are associated with the certificate profiles stops.

Conclusion

I hope this guide helps anyone looking to code sign their desktop applications using Microsoft Azure Trusted Signing without having to purchase additional EV/OV certificates.
Thank you for taking the time to read this article!
If you notice any issues, find something that could be improved, or have a better approach, please feel free to leave a comment. I'd be happy to hear your feedback and learn from your suggestions.
Happy coding!