The Onboarding Script Is Now Digitally Signed

July 14, 2026 · InfraScout Team

The onboarding script you run in your own Entra tenant to create the InfraScout app registration — create-infrascout-customer-app.ps1 — is now Authenticode-signed with a publicly-trusted, Microsoft-issued certificate. If you download the script to set up InfraScout, the copy you get is already signed, so you can verify who published it before you run a single line.

Why signing the onboarding script matters

This script is usually the very first InfraScout code you execute. It provisions the app registration in your tenant and grants the Graph permissions InfraScout needs to run assessments, so it is exactly the kind of script a careful admin should not run without knowing where it came from.

An unsigned script gives you no cryptographic proof of publisher or integrity, and under a stricter PowerShell execution policy such as AllSigned or RemoteSigned, it can be blocked outright or trigger an unknown-publisher warning. Signing removes that friction and, more importantly, gives you something to verify.

The signature is produced through Azure Trusted Signing, a Microsoft-operated public code signing service, using a "Public Trust" certificate profile. The publisher identity attached to the signature is ITdesign Software Projects & Consulting, the legal entity operating InfraScout, based in Vienna, Austria.

Verify before you run

You do not have to take our word for the publisher — Windows and PowerShell will tell you directly. After downloading the script, check its signature from a PowerShell prompt:

Get-AuthenticodeSignature -FilePath '.\create-infrascout-customer-app.ps1'

A valid, publicly-trusted signature reports a status of Valid and names ITdesign Software Projects & Consulting as the signer, with the certificate chaining up to a Microsoft-issued public root. If the file has been tampered with in transit, or the signature is missing, the status will not come back Valid — and that is your cue not to run it. You can also right-click the script, open Properties, and review the Digital Signatures tab for the same information.

One consistent trust chain

This extends a trust story that already covers the software you deploy. The Windows agent binaries went through the same public code signing service earlier, as described in Windows Agent Binaries Are Now Digitally Signed. Now the script that bootstraps your tenant carries the same publisher identity as the agents it eventually connects.

The result is a single, verifiable identity across the InfraScout software you touch — from the onboarding script you run first to the agents you install afterward. Security teams that want to confirm provenance independently, rather than trust a download page, can do so at every step.

Signing proves origin, not intent

A valid signature confirms who published the script and that it has not been altered. It does not replace reading and understanding what the script does before you run it in your tenant. The onboarding script's actions — creating the app registration and requesting Graph permissions — are worth reviewing on their own merits, and we document them so you can.

Learn more

For the full onboarding walkthrough, including what the script provisions and the permissions it requests, see Deploy on Windows.

Questions or feedback? Reach us at info@infrascout.cloud.