Windows Production Requirements
This guide covers white-label Windows apps distributed directly to customers as an MSI installer. Set up your publisher identity and update hosting before your first production build.
What you need
| Requirement | What to prepare |
|---|---|
| App details | Your application name, stable App Identifier, Windows version and branding. |
| Production signing | Your own Azure Artifact Signing account with a verified Public Trust certificate profile. |
| Publisher details | The exact verified certificate subject, including its CN, O and C components where present. |
| Signing access | Azure tenant, client and subscription IDs, signing endpoint, account and profile names, plus the project’s federated identity and signer permissions. |
| Update hosting | Your own HTTPS folder or file-sharing service with permanent, direct download URLs. |
| Update signing keys | Your project’s matching Update Private Key and Update Public Key, configured in App Store. |
Choose a production signing method
In App Store → Windows → Signing method, select Customer Azure signing for production under your own company’s publisher identity. Complete Azure identity validation and create a Public Trust certificate profile. Microsoft manages the certificate and private key; no PFX upload is required.
The default SessionTalk signing option is for test builds and displays SessionTalk Ltd as publisher. Testers do not need to install a self-signed certificate. For production using your own identity, configure Customer Azure signing. See Microsoft’s code-signing options .
Follow the Windows Code Signing guide to configure Azure federation and the certificate profile’s signer permissions. Copy the exact federation subject displayed for your project in the portal. Connection identifiers alone do not authorise signing.
Enter your portal details
- Open your project and select App Store.
- Set the application name and App Identifier. Keep the App Identifier stable for subsequent releases.
- Under Windows, enter Windows Version, select Customer Azure signing, and supply the Azure connection details and verified publisher subject. Configure the matching federated identity and profile permissions in Azure.
- Set Windows Update Url to your own update folder, such as
https://downloads.example.com/softphone/windows. Enter the folder URL without a trailing slash orwinconfig.xml. - Configure the matching Update Private Key and Update Public Key. Keep these keys for later releases; they are separate from your Windows code-signing certificate.
- Save the project and complete the normal approval and build process.
Keep the application’s existing MSI upgrade identity for future versions. Changing the identity can cause Windows to treat a release as a separate app rather than an upgrade.
Before distributing
Download the completed build ZIP and test the signed MSI on a separate Windows PC. Check the publisher displayed by Windows and verify an update from an earlier installed version. Code signing does not guarantee that a new app will immediately have SmartScreen reputation; Microsoft explains how signing affects Windows trust .
Publish the installer and its generated update files using Windows App Updates. The build download alone does not publish updates to your hosting.