I'm using the following tutorial to define a workflow on a SharePoint list to create an element in and external List.

When the workflow action tries to create the item in the external list, it fails with this message:

The workflow could not update the item in the external data source. Make sure the user has permissions to access the external data source and update items.

I found the following in the logs:

The security configuration of the LobSystemInstance does not permit running a workflow activity. Use Secure Store credentials for this LobSystemInstance to enable this scenario.

I'm an administrator, and I've set up full control for me on the Sharepoint list and on the external list.

(the bottom of the tutorial has a comment with the same error message, but no response).

Where can I setup the extra security that the error message is asking for?

3 Answers 3


Central Administration > Application Management > Service Applications > Manage service applications > Business Data Connectivity Service

Select your external content type, click Set Object permissions and edit them.

  • I have already done this. I've checked all permissions for my domain user but it does not work. Sep 16, 2011 at 15:18

You need to go to Central Admin and set permissions on the Object as well as the Metadata Store. These permissions are what allow you to use the operations in the connection to the external content type.

  • I've done this and it does not work. Sep 16, 2011 at 15:21
  • 1
    Have you verified that create, update, and delete were operations that were created for this connection when the read operation was created? it is definitely a permissions issue, you may also check the permissions on the database for the account that is being used to connect.
    – Lori
    Sep 16, 2011 at 16:35
  • The external content datasource is WCF service (basic HTTP binding just to keep it simple). I have only "Read List", "Read Item" and "Create" as operations. I'm doing create with my workflow. Creating items directly works fine but when doing it with the workflow I get the above error. Sep 19, 2011 at 7:36
  • What type of workflow are you using?
    – Lori
    Sep 19, 2011 at 14:20

Looking at that tutorial, the part that stood out to me was this:

Workflows accessing Business Data Connectivity (BDC) service always run as a service account, even under the impersonation step. A workflow always runs as a service account and is supported only when using Secure Store Service or RevertToSelf (which is disabled by default because of security implications ...

This seems to correlate with the error message in your logs.

Unfortunately I haven't set the Secure Store Service up myself, but the following documentation page has several links to articles on setting it up and configuring it:

MSDN: Secure Store Service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.