---
title: "Signer - Setup on Azure App Services"
description: "Installing an on-premises Signer on Azure App Services: the binaries package and creating the SQL database, the storage account and the App Service."
canonical: "https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/azure"
locale: "en"
product: "Signer"
last_updated: "2026-10-22"
---

# Signer - Setup on Azure App Services

To install an [on-premises](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises) instance of [Signer](https://docs.lacunasoftware.com/en-us/articles/signer) on an [Azure App Service](https://docs.microsoft.com/azure/app-service/overview),
follow the steps below. For other platforms, [click here](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises).

## Preparation

Before you start, get the binaries package:

**[Signer binaries package](https://cdn.lacunasoftware.com/signer/signer-3.0.0.zip)**

The instructions below assume you already have the following *resources* in your Azure account:

* A *SQL Server* (creating the *SQL database* is covered in this article)
* An *App Service Plan* (creating the App Service is covered in this article)
* A DNS zone for the site's domain

During the installation, you will create these *resources*:

* A database (*SQL database*)
* A *storage account*
* An App Service

We suggest creating a **resource group** to hold them. That is only for organization, though. What really matters is
that **all resources are created in the same region**. This is essential for the system to work properly.

> **Note**
>
> The steps below describe the most basic setup of each resource. Depending on your infrastructure, you may want to take
> extra security or resilience measures, such as restricting access to a private network.

## Creating the database

Follow the steps below to create a database for the system (you need an existing *SQL Server*):

1. In **SQL databases**, click **+ Create**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (using the region chosen for the system)
1. Click the **Additional settings** tab
1. In **Collation**, enter `Latin1_General_100_CI_AI`
1. Click **Review + create**
1. Click **Create**

> **Warning**
>
> The database *collation* **MUST BE** `Latin1_General_100_CI_AI`. Creating the database with a different *collation* will most likely make the installation fail!

Once the database is created, click **Go to resource**. Then get the *connection string*:

1. Click **Connection strings**
1. Take note of the connection string shown in the **ADO.NET (SQL authentication)** section

> **Note**
>
> In the copied connection string, replace `{your_password}` with the database password

## Creating a *storage account*

We need a *storage account* to store files (the system keeps files outside the database to keep it lean) and also the
system logs. Follow the steps below to create a *storage account* (if you want to use an existing account, skip this part):

1. In **Storage accounts**, click **+ Create**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (using the region chosen for the system)
   * In *Performance*, choose **Standard**
   * In *Redundancy*, choose the option you prefer (we suggest **Zone-redundant storage (ZRS)** -- [click here](https://azure.microsoft.com/documentation/articles/storage-redundancy/)
     for details on the replication options)
1. Click **Review**
1. Click **Create**

Once the *storage account* is created, click **Go to resource**. Then get a *connection string*:

1. In the *storage account* settings, click **Access keys**
1. In the **key1** section, take note of the **Connection string** field

## Creating the App Service

Follow the steps below to create an *App Service* (you need an existing *App Service Plan*):

1. In **App Services**, click **+ Create**
1. On the first tab (*Basics*), fill in the fields according to your infrastructure (using the region chosen for the system)
   * In *Publish*, choose **Code**
   * In *Runtime stack*, choose **.NET 10 (LTS)**
   * In *Operating System*, choose the one you prefer (the system runs on Windows and Linux)
1. Click **Review + create**
1. Click **Create**

Once the App Service is created, click **Go to resource**. Then take note of:

* its domain, for example `my-app-service.azurewebsites.net`
* the **Custom Domain Verification ID**, shown under **Custom domains**

## Configuring the domain

Create the DNS records for the site's domain:

> **Note**
>
> In the instructions below, we use the domain `app.patorum.com` as an example

1. In **DNS zones**, click the zone the domain belongs to (e.g. `patorum.com`)
1. Click **+ Record set**
1. In *Name*, type the leftmost part of the domain (e.g. `app`)
1. In *Type*, select **CNAME**
1. In *Alias record set*, select **No**
1. In *Alias*, enter the App Service domain (e.g. `my-app-service.azurewebsites.net`)
1. Click **OK**
1. Click **+ Record set** again
1. In *Name*, type `asuid.` followed by the leftmost part of the domain (e.g. `asuid.app`)
1. In *Type*, select **TXT**
1. In *Value*, paste the **Custom Domain Verification ID** you noted from the App Service
1. Click **OK**

> **Note**
>
> If you don't use Azure as the DNS server for your zones, do the equivalent on your DNS server

After creating the records, add the domain to the *App Service*:

1. Back in the App Service settings, click **Custom domains**
1. Click **+ Add custom domain**
1. Select **All other domain services**
1. Keep **App Service Managed Certificate** and **SNI SSL** selected
1. In *Domain*, enter the domain (e.g. `app.patorum.com`)
1. Click **Validate**
1. After validation, click **Add**

## Copying the binaries

Now we copy the site binaries. First, in the App Service **Overview**, stop the service by clicking **Stop**.

Then go to **Advanced Tools** and click **Go**. This opens the App Service's Kudu control panel.

1. In the top menu, click **Tools**, then **Zip Push Deploy**
1. Drag and drop the binaries package (.zip file) onto the file list and wait for the *deploy* to finish

## Configuring Signer

Run the command below in PowerShell to generate the key used to encrypt sensitive values in the database:

```ps
$k = New-Object byte[] 32;
[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($k);
[Convert]::ToBase64String($k);
```

Take note of the generated value.

In the App Service, go to **Configuration** and add the following settings:

* `ASPNETCORE_ENVIRONMENT`: `Azure`
* `General__EncryptionKey`: the encryption key generated above
* `General__SiteUrl`: the public URL of the site, on the domain configured earlier, e.g. `https://assinador.patorum.com/`
* `General__SiteName`: the name of your Signer instance, e.g. *Patorum Signer*
* `General__SupportEmailAddress`: the support email address (used in the footer of outgoing emails)
* `General__Theme` (optional): the site's color scheme, as a three-letter code such as `acr` (amazon + cornell-red). See the [available themes](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/customization/temas)
* `AccessControl__IsOpen`: by default, the system is "closed": users must first be added to an organization before they can use it.
  To make the system "open", that is, to let users sign up and use it freely (without an administrator's approval), add this setting with the value `true`. See [Access Control](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/access-control)
* `DocumentTypes__Enabled`: by default, the document type selection is not shown when creating documents. To show it, add this setting with the value `true`
* `ElectronicSignature__Enabled`: by default, electronic signatures (without a digital certificate) are disabled. To enable them, add this setting with the value `true`

Also add the settings described in the sections below.

### PKI Suite

PKI Suite settings:

  * `PkiSuite__SdkLicense`: your PKI SDK license, in Base64 format (**required**)
  * `PkiSuite__WebLicense`: your Web PKI license, in binary (Base64) format (**required**)
  * `PkiSuite__LappEnabled`: `true` or `false`. Whether to enable [LAPP](https://docs.lacunasoftware.com/en-us/articles/lapp), the fallback source of CRLs and CA certificates (**optional**)

### Email sending

Email sending settings:

  * `Email__Enabled`: by default, email sending is enabled. To disable it, set this setting to `false` and skip the rest of this section.
  * `Email__ServerHost`: *hostname* of the SMTP server
  * `Email__EnableSsl`: by default, the SMTP conversation runs over SSL. To disable SSL, set this setting to `false`
  * `Email__ServerPort`: by default, the SMTP conversation uses port 587. Set this setting to use a different port
  * `Email__Username` and `Email__Password`: set these if the SMTP server requires authentication
  * `Email__SenderAddress`: the email address used as the sender (*From* field)
  * `Email__SenderName`: the name used as the sender name (optional)

### OpenID Connect provider integration

Signer requires an OpenID Connect (OIDC) provider, more specifically a [GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id) *subscription*.

You can use a *subscription* on our SaaS service at [grantid.com](https://grantid.com/) or [install your own GrantID instance](https://docs.lacunasoftware.com/en-us/articles/grant-id/on-premises).

With your GrantID *subscription* parameters at hand, add the following settings:

* `Oidc__Authority`: the *OIDC authority* (e.g. `https://patorum.grantid.com`)
* `Oidc__ApiEndpoint`: the GrantID API address (e.g. `https://api.grantid.com`)
* `Oidc__ApiName`: the API scope required in access tokens
* `Oidc__ClientAppId`: the *App-Id* of the frontend application
* `Oidc__AppId`: the *App-Id* of the backend application
* `Oidc__AppSecret`: a secret to authenticate the backend application
* `Oidc__CpfClaim`: the name of the subscription's CPF *claim*, if it is not `cpf`
* `Oidc__CustomScopes`: the name of the subscription's CPF scope
* `Oidc__RequireHttps` (optional): set to `false` if you use your own GrantID instance without HTTPS (not recommended)

> **Tip**
>
> If the subscription uses the CPF as the key, set both `Oidc__CpfClaim` and `Oidc__CustomScopes` to `preferred_username`

### Blob Storage

*Storage account* settings:

* `BlobStorage__ConnectionString`: the *connection string* of the *storage account* created earlier
* `BlobStorage__ContainerName` (optional): the name of the *container* used to store files. If omitted, a container named *signer* is used.

### Logging

Log settings:

* `Serilog__WriteTo__0__Args__connectionString`: the *connection string* of the *storage account* created earlier
* `Serilog__WriteTo__0__Args__storageTableName` (optional): the name of the table used to store the logs. If omitted, a table named *SignerLog* is used.

### Connection string

In the *Connection strings* section (at the end of the configuration page), click **+ New connection string** and fill in:

* **Name**: `DefaultConnection`
* **Value**: the connection string obtained when creating the database
* **Type**: choose **SQLAzure**

Save the settings so far by clicking **Save**.

## Starting the App Service

Finally, in the App Service **Overview**, click **Start**. Then open the site URL (the first access may take a few moments).

Click **Login** and sign up. You are then "promoted" to administrator (the first user who signs up is promoted automatically),
with full access to the system, and the installation is complete.

## See also

* [Updating Signer on Azure App Services](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/azure/update)