What is Azure Artifact Signing?
Azure Artifact Signing (formerly Azure Trusted Signing) is a managed service for signing software artifacts such as container images, Windows binaries, and packages. The service uses Hardware Security Modules (HSMs) for secure key management and enables integration into CI/CD pipelines. Accounts come as Basic or Premium SKU, which differ in the number of certificate profiles and the included signature quota.
Signed artifacts can be verified by recipients to ensure integrity and provenance.
Core Features
- Container image signing with Notation (CNCF standard)
- HSM-protected key management without own hardware
- Integration with Azure Container Registry (ACR)
- Support for various signature formats
- Audit logging of all signing operations
- RBAC-based access control for signing keys
Typical Use Cases
Container supply chain security: Sign container images before pushing to the registry. Kubernetes can be configured to only deploy signed images.
Software distribution: Sign installation packages and binaries so end users can verify the authenticity of the software.
Compliance requirements: Demonstrable code signing for regulated industries like financial services or healthcare.
Benefits
- No own HSM management required
- Seamless integration with Azure DevOps and GitHub Actions
- Reduced complexity compared to self-hosted solutions
- Centralized management of all signing keys
Frequently Asked Questions
Which artifact types are supported?
Azure Artifact Signing supports container images (OCI format), Windows binaries, NuGet packages, and other formats. The Notation integration enables signing container images according to the CNCF standard.
How are the signing keys protected?
All private keys are stored in FIPS 140-2 Level 3 certified Hardware Security Modules (HSMs). The keys never leave the HSM.
Can I use existing certificates?
For some scenarios, custom certificates can be imported. For container signing, Azure-managed certificates that are automatically renewed are recommended.
How do I verify signed artifacts?
Container images can be verified using the Notation CLI or integrated Kubernetes admission controllers. Public certificates are provided in Azure Key Vault or a trust store.
What does Azure Artifact Signing cost?
The service is billed via Basic or Premium accounts with a monthly base fee and an included signature quota; additional signatures are billed per unit. Premium offers more certificate profiles and a higher quota than Basic. See the official pricing page for details.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Artifact Signing: implementation in CI/CD pipelines, Kubernetes integration, and supply chain security.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
