Considerations:

• Do yourself a favor and get a digicert. I first ordered a comodo cert and discovered that I couldn’t install it into the Azure Keystore.
• I mostly followed the formal guide, however, I found some bits confusing, specifically the Creating a certificate signing request (CSR) and the app permissions

I based my process heavily on the guide @ Setup Microsoft Azure Key Vault with Verokey/DigiCert Code Signing Certificate

From the above URL:

Enter the details of the new Certificate. You will need to select Certificate issued by a non-integrated CA for the Type of CA.

The subject won’t be used for your certificate issued, but you do need to enter something in the field.

Click Not Configured for the Advanced Policy Configuration to show the new panel.

In the new Panel, For the Extended Key Usage field, add a new value to the end: 1.3.6.1.5.5.7.3.3

This is to enable code signing on the key/certificate.

You need to make the following selections for the Policy Configuration:

No for Exportable Private Key. This will then show more options under Key Type.

Select RSA-HSM or ECC-HSM and a compatible key size.

For RSA-HSM, you need to select a key size of 4096.

Click OK and Create your new Certificate.

You can then go back to the screen connect formal guide. When you get to the section:

Using your code-signing certificate with ScreenConnect

You need to create a new app registration in entra, however the formal guide has an error.

Create a secret by navigating to Certificates & secrets. Create a new client secret, and copy the Secret ID field.

The above line is incorrect, you want to copy the VALUE field as that is the password to the application. It is only displayed once so be sure to copy it!

The app might work with less permissions, but I couldn’t make it work without key vault administrator

Once you’ve created your application. Go back into Azure, back into your keyvault.

Go into the above button.

Select Key Vault Administrator

In the search box that pops up type in the name of your app

then go review and assign

Now wait 15min to ensure everything has applied.

To get the code signer URI:

Go back into your key vault:

click on the certificate, click on the thump print and it should give you the correct URI

Is the above box enter the values you’ve saved, NOTE: Azure Client Secret is the VALUE field from above NOT the SECRET ID.

Click install azure certificate and after a few minutes it should work.