SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get Azure Workflow Service running on SharePoint 2013.

When running the Register-SPWorkflowService powershell commandlet i get the following error:

Register-SPWorkflowService : The caller does not have the necessary
permissions required for this operation. Permissions granted: None. Required
permissions: ReadScope. HTTP headers received from the server - ActivityId:
221b6fef-bb5d-4455-a572-2c5a035e323a. NodeId: WIN-K19UNMVBQ40. Scope:
At line:1 char:1
+ Register-SPWorkflowService -SPSite "http://server" -WorkflowHostUri
"http://WIN- ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidData: (Microsoft.Share...WorkflowService:
   RegisterSPWorkflowService) [Register-SPWorkflowService], UnauthorizedAcces
    + FullyQualifiedErrorId : Microsoft.SharePoint.WorkflowServices.PowerShell

Any pointers? I'm running the workflow service as the SPSetup account and I'm logged in as the SPSetup account. This account is also sysadmin on the SQL Server, should therefore have all permissions?

share|improve this question
up vote 1 down vote accepted

I have heard rumors that configuring this also requires the User Profile service application to be configured so that the OAuth/claims augmentation/etc. stuff can all be in place. Unfortunately I haven't had the chance to confirm this yet.

share|improve this answer
Very interesting - will try to configure everything SharePoint related. – Dennis G Aug 22 '12 at 21:19
I don't know whether that was it, but after starting all possible Services via CA (including User profile service), the Powershell command did not result in an error. – Dennis G Aug 23 '12 at 11:30

My experience with this is I forgot to put the account I was logged in as on the SharePoint server in the Workflow Manager Admin group. Added the account, logged out and back in (so I would get a new token), and it worked fine. I guess there is an admin group for a reason, right? :)

share|improve this answer

I had a similar error but I got it working based on this blog.

Just to help anyone else who may experience the same, here's an excerpt:

You may receive one of the following errors and I’ve commented each with the resolution I used:




Register-SPWorkflowService : The caller does not have the necessary permissions required for this operation. Permissions granted: None. Required permissions: WriteScope. HTTP headers received from the server - ActivityId: 5e2b96c5-f971-48c9-b3fd-405c3616e1c7. NodeId: SP2. Scope: /SharePoint. Client ActivityId : 8e592951-0027-40c6-b996-ba3dd194fdea.

CONTOSO\svcSetupAcct is not a member of the workflow admin group, CONTOSO\WFAdmins.

Add CONTOSO\svcSetupAcct to CONTOSO\WFAdmins and re-run Register-SPWorkflowService PowerShell cmdlet. You may need to logout and log back in to acquire an updated security token.

Register-SPWorkflowService -SPSite url -WorkflowHostUri url –AllowOAuthHttp Register-SPWorkflowService : Cannot open database "WSS_Content_WFTest"

requested by the login. The login failed.

Login failed for user 'CONTOSO\svcsetupacct'.

CONTOSO\svcSetupAcct has not been granted ShellAdmin access to the WSS_Content_WFTest content database.

Grant CONTOSO\svcSetupAcct shell admin access to the desired content database using PowerShell similar to the following: Add-SPShellAdmin CONTOSO\svcSetupAcct –database (Get-SPContentDatabase WSS_Content_WFTest)

Register-SPWorkflowService -SPSite url -WorkflowHostUri url Register-SPWorkflowService : Failed to query the OAuth S2S metadata endpoint at URI. Error details: 'The metadata endpoint responded with an error. HTTP status code: Forbidden.'. HTTP headers received from the server - ActivityId: b5163152-3e31-4809-a532-5e20d1320027. NodeId: WF. Scope: /SharePoint. Client ActivityId : b66b0ea4-d9a7-4d2d-8be8-3a0c58ab728c.

Incorrect use of parameters

Notice that the SharePoint site is non-SSL, but the parameter for –AllowOAuthHttp was not specified. For a non-SSL SharePoint site, the parameter –AllowOAuthHttp must be used.

share|improve this answer

In local installations, the account executing Register-SPWorkflowService must be able to write to the -SPSite site collection database (or even be owner - I used GrantAccessToProcessIdentity on the web app as I don't have management access to the SQL server) and member of the Workflow admin group (Get-WFFarm).AdminGroup.

share|improve this answer
You shouldn't do this. Registering the workflow service you would do in a PowerShell instance running under farm credentials. The Farm administrator registers the WorkflowService with a site collection. The account running the workflow service shall not have access to the site collection database - that would defeat the whole purpose of having a decentralized workflow engine talking only via REST web services to SharePoint. – Dennis G Jan 29 '13 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.