I'm trying to set-up Access Services in SharePoint 2013, in a multi-tenant environment. I've followed Anne's guide

With the following adjustments:

  1. I did not set-up a new SQL instance just for Access, I am using the current SP SQL instance.
  2. I did not start Access Services 2010 as I believe it is an optional step and it is for backward capability.
  3. I did not create an empty web application as I'm not sure if that is necessary in a HNSC environment.

The issue is when I go and create an Access App, it would error. And in the details page:

"There was a problem accessing the app's database. Details: Access is denied to the Secure Store Service."

Upon looking up the correlation ID, the error is:

Exception while executing task e55e0fbc-bce5-4f3a-ae66-27d118607639 of type Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup in job 17bbb974-f59e-4001-ad7d-598f09748dee for instance 5155ff9a-08a0-43c9-80a8-ec0845c62fb7 sitesubscription 39d493f9-4883-4f89-a120-6c4d28a534a0, rollback = False: Microsoft.Office.SecureStoreService.Server.SecureStoreServiceException: Access is denied to the Secure Store Service. at Microsoft.SharePoint.Utilities.SecureStoreHelper.ExecuteSecureStoreMethod(String methodName, Object[] args) at Microsoft.SharePoint.Utilities.SecureStoreHelper.EnsureTargetApplication(ITargetApplicationDefinition targetApplication, IList1 targetApplicationFields, IList1 adminClaims, IList`1 groupClaims, Boolean addSystemClaim, Boolean& created) at Microsoft.SharePoint.Packaging.SPAppDeploymentUtility.WriteConnectionStringPartsToSecureStore(String targetApplicationId, Guid appInstanceId, SPSite site, NetworkCredential dboCredential, NetworkCredential loginCredential, String groupAccount) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.CreateTargetAppAndStoreCredentials(String dbConnStringSsoApplicationId, NetworkCredential dboCredential, NetworkCredential loginCredential, String groupAccount) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.DeployInternal(Stream dacFileStream, Stream dataPopulationScriptStream) at Microsoft.SharePoint.Packaging.SPDatabaseDeploymentGroup.Deploy() at Microsoft.SharePoint.Administration.SPAppTask.DeployOperation() at Microsoft.SharePoint.Lifecycle.MonitoredTaskExecution.DoTask()

So it looks like it is having issue creating the target application.

I've given the service account for the Access Services, and also the web application full control on the Secure Store, both the Administrator and the Permissions section. I've also explicitly given them dbo access to the Secure Store database and also the dbcreator and securityadmin server roles.

Secure Store itself works fine with no issue.

I'm wondering if it has anything to do with multi-tenancy setup, where target applications are setup at the tenant level, but Access Services is trying to create it at the farm level?

  • I think i got an answer, but I'll do a proper write up later. I created another instance of Secure Store and set that as the default, and then I was able to create Access Apps. However since the default SSS is now switched to the none partitioned instance, the original partitioned instance is now "disabled". I believe I need to create a separate web application and have the farm level SSS associated to that and have the tenant level SSS staying with the existing web application. – Rick Dec 3 '15 at 6:06
  • The new web application option doesn't work - the tenant site still looks for a non-partitioned SSS and then hits the same access denied error. Just out of curiosity, has anyone done this before? How do you deploy Access Services to a multi tenant environment where the SSS is partitioned? Why does Access Service keep looking for a non-partitioned SSS? – Rick Dec 10 '15 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.