# Verify software builds in a tamper-proof manner

> Microsoft records production builds of selected cloud services in a publicly accessible and cryptographically protected ledger. Only software builds registered in this registry are permitted to be deployed to the production systems of the relevant cloud infrastructure. Customers and independent auditors can use public verification tooling to independently validate the integrity and provenance of software artifacts.

**Sector:** Tertiary sector · **Industry:** IT security · **Organisation:** Microsoft · **Maturity level:** Production

Canonical URL: https://www.sapientblock.com/en/use-cases/microsoft-software-builds-oeffentlich-manipulationssicher-nachweisen

## Documentation status

- **Project status:** Production
- **Evidence:** Evidence medium
- **Editorial review:** pending

## Description

Microsoft relies on the Signing Transparency Ledger, a tamper-proof register, to make the origin and correctness of cloud software publicly verifiable. In modern IT, unnoticed interventions in development and build pipelines represent one of the greatest security risks for companies. By linking cryptographic proofs to strict rollout policies, it is ensured that unverified software cannot be executed in practice.

With the Microsoft Signing Transparency (MST) initiative, Microsoft addresses the trust issue in the software supply chain at its root. Production builds of selected cloud services are automatically recorded in an append-only ledger based on the Confidential Consortium Framework and the Azure Confidential Ledger. The implementation follows the standards of the IETF SCITT working group to ensure cross-vendor interoperability. Deployment in the production environments of the respective services is technically blocked if there is no valid entry in the ledger for the respective build artefact. Customers and independent auditors have the opportunity to validate the cryptographic chain completely via open verification tools without needing to view confidential source codes.

## Benefits

- Reduction of liability and security risks in cloud services
- More efficient provision of evidence to regulatory authorities
- Increased trust in the integrity of provided enterprise software
- Tamper-proof logging of all relevant software builds
- Publicly accessible and independent verifiability for third parties
- Automated prevention of unauthorised software rollouts
- Increased transparency across the entire digital supply chain
- Clear and automated quality and deployment policies
- Reduced error susceptibility in operational release processes

## Challenges

- Required internal expertise to use the verification tools
- Adaptation of existing IT audit processes to cryptographic verification methods
- Complexity in integration into high-volume, global release pipelines
- Need to enforce uniform interface standards such as SCITT
- Stricter policies limit manual exception approvals during rollouts

## Technology foundation

The solution is based on Azure Confidential Ledger and the Confidential Consortium Framework using SCITT standards (Supply Chain Integrity, Transparency, and Trust) for a tamper-proof append-only register.

## Sources

- [About Microsoft's Signing Transparency Ledger](https://learn.microsoft.com/en-us/azure/confidential-ledger/about-microsoft-signing-transparency-ledger)
- [Microsoft Leads a New Era of Software Supply Chain Transparency](https://techcommunity.microsoft.com/blog/microsoft-security-blog/microsoft-leads-a-new-era-of-software-supply-chain-transparency/4528369)