{"id":73426,"date":"2026-08-05T22:33:50","date_gmt":"2026-08-05T20:33:50","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73426"},"modified":"2026-08-05T22:33:50","modified_gmt":"2026-08-05T20:33:50","slug":"code-signing-microsoft-artifact-signing","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/sichere-softwarebereitstellung\/code-signing-microsoft-artifact-signing\/","title":{"rendered":"Code Signing: own certificate or Microsoft Artifact Signing?"},"content":{"rendered":"
\"Sichere<\/span>

\u2190 Secure software delivery<\/a><\/p>

Code Signing: own certificate or Microsoft Artifact Signing?<\/h1>

Derive the appropriate signing strategy from the trust model, delivery route and operational capability.<\/strong><\/p><\/div><\/div>\n\n\n\n

Code signing binds origin and integrity to an artifact: Recipients can check whether it has been changed since it was signed and which certificate the signature is assigned to. It does not check whether the code is defective. A separate certificate is suitable for key sovereignty or offline signing requirements; Microsoft Artifact Signing provides an Azure managed service for supported integrations. What matters is the trust model, CI\/CD, roles, recovery and costs - not just the signature command.<\/p>\n<\/div>\n\n\n

Background<\/h2>\n\n
\"Sichere<\/figure>
\n

Release teams want to sign applications, scripts or guidelines. Which artifact types and integrations Artifact Signing supports is the current one Microsoft Learn documentation<\/a> to be taken from; No blanket support for containers can be derived from this. A local key can enable offline scenarios, but creates protection, access, rotation, and emergency overhead. A managed service reduces direct key management but makes release dependent on Azure resources, identities, supported endpoints, and service status.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Technical context<\/h2>\n\n

Microsoft currently runs the Azure service as Artifact Signing<\/strong> (formerly Trusted Signing). The service manages the certificate lifecycle; documented trust scenarios and integrations as well as region, identity and account type requirements must be checked in the target tenant before use. This is a vendor information, not a promise of unchanged availability, regions or feature equivalence.<\/p>\n\n\n\n

Signing is a trust building block for the release and can be used for rules App Control for Business and monitoring<\/a> support. It does not replace malware scanning, code review, SBOM, testing or incident response. CRA and NIS2 require risk-based requirements; This site does not claim any explicit general signing obligation.<\/p>\n<\/div>\n\n\n

Decision: own certificate or artifact signing?<\/h2>\n\n
\"Abstrakte<\/figure>
\n
\n\n
Trust objective<\/summary>

Own certificate:<\/strong> Own trust chain and certificate choice
Microsoft Artifact Signing:<\/strong> Managed profiles within Microsoft models<\/p><\/details>\n\n

Artefact type<\/summary>

Own certificate:<\/strong> Determine by certificate, tooling and recipient
Microsoft Artifact Signing:<\/strong> Only currently documented formats and integrations<\/p><\/details>\n\n

Key model<\/summary>

Own certificate:<\/strong> Control depends on CA, HSM\/Token, Cloud KMS and operations
Microsoft Artifact Signing:<\/strong> Key and certificate lifecycle managed by Microsoft<\/p><\/details>\n\n

Offline capability<\/summary>

Own certificate:<\/strong> Possible depending on your own infrastructure
Microsoft Artifact Signing:<\/strong> Signing job requires service access; Plan offline fallback<\/p><\/details>\n\n

Identity and RBAC<\/summary>

Own certificate:<\/strong> Implement your own authorisation model
Microsoft Artifact Signing:<\/strong> Azure RBAC; et al. `Artifact Signing Certificate Profile Signer` and `Artifact Signing Identity Verifier`<\/p><\/details>\n\n

CI\/CD<\/summary>

Own certificate:<\/strong> Proprietary tooling\/secrets\/HSM integration
Microsoft Artifact Signing:<\/strong> SignTool, GitHub Actions, Azure DevOps, PowerShell, Azure PowerShell and SDK documented<\/p><\/details>\n\n

Lifecycle<\/summary>

Own certificate:<\/strong> Procurement, protection, rotation and revocation yourself
Microsoft Artifact Signing:<\/strong> certificate profiles and managed lifecycle; Identity validation remains a process task<\/p><\/details>\n\n

Volumes and Regions<\/summary>

Own certificate:<\/strong> Design capacity and availability yourself
Microsoft Artifact Signing:<\/strong> Check quotas and regions in the target tenant<\/p><\/details>\n\n

Business Continuity<\/summary>

Own certificate:<\/strong> Provide replacement key and locking process
Microsoft Artifact Signing:<\/strong> Document outage, region and service change procedures<\/p><\/details>\n\n

Revocation and incident<\/summary>

Own certificate:<\/strong> Operate the revocation, investigation and communication process yourself
Microsoft Artifact Signing:<\/strong> Align role, revocation and incident processes with service dependencies<\/p><\/details>\n<\/div>\n\n\n\n\n

Current requirements and prices are available on the Azure pricing page for Artifact Signing<\/a>. They must be checked for the contract, region and target tenant before procurement; Specific price or quota information does not belong on this page.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n
    \n
  1. Which artifacts and trust recipients require which trust profiles?<\/li>\n
  2. Which service or person is allowed to trigger a signature - and is a pipeline identity allowed to do this?<\/li>\n
  3. How are release, timestamps, audit trails, revocation and rotation proven?<\/li>\n
  4. Which critical releases need a tested offline or replacement process?<\/li>\n
  5. How does the pipeline separate build, security review, release and signing?<\/li>\n<\/ol>\n<\/div>\n\n\n

    Working with ADIUMENTO<\/h2>\n\n
    \"Team<\/figure>
    \n

    Whether a signing architecture or a pilot is suitable as a project component depends on the specific order and confirmed portfolio. Product details are on Technologies<\/a> and benefits Services<\/a> to find.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

    Typical deliverables<\/h2>\n\n