I signed up to generate certificates to sign my code as an individual developer. I cannot create a role as it seems a Microsoft Entra ID P2 or Microsoft Entra ID Governance license is needed (at extra cost). I thought the $9.99 plan would allow it?

Question

I signed up as a new Azure customer to generate certificates to sign my code as an individual developer. I cannot create the a role 'Trusted Signing Identity Verifier' and the reason seems to be "The tenant needs to have Microsoft Entra ID P2 or Microsoft Entra ID Governance license" which seem cost more. I thought the $9.99 plan would allow me to sign without additional cost(s)?

Answer 1

Hello Tom Gitlin,

You don’t need a Microsoft Entra ID P2 or Governance license to assign the Trusted Signing Identity Verifier role. This role is part of Azure Trusted Signing and can be assigned using standard Azure RBAC, which is available in all tenants.

The $9.99 Trusted Signing plan covers certificate creation and signing. Entra ID premium licenses are only needed for advanced governance features (like Access Reviews or Entitlement Management), which are not related to Trusted Signing.

If you’re seeing any error, make sure you have Owner or User Access Administrator permissions on the resource or subscription.

Now, click “Add role assignment” under the Access Control (IAM) tab ->Search for “Trusted Signing Identity Verifier” and assign it to your user account.

If you assign the role at the Trusted Signing account level, it should work without requiring any additional license.

You can find more details here: Trusted Signing resources and roles

Hope this helps! Let me know if any further queries.

---

If this answers your query, do click Accept Answer which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.