I have a SharePoint 2013 environment with several High-Trust Addins. This must now be upgraded to SharePoint 2016.

My Questions:

  1. I was unable to find any documentation on the required steps. Links are welcome.
  2. Do i have to migrate App-Management Service and Subscription Settings Service? Microsoft Docs don't even mention them. Technet Forums say yes, but linked background is no longer available.
  3. During initial setup on SharePoint 2013, i had to create a New-SPTrustedSecurityTokenIssuer. In this step, a RegisteredIssuerName had to be specified. This IssuerName consists of the Realm and the IssuerID.
    • I think IssuerID can and should be migrated to SharePoint 2016, as it it also defined inside the High-Trust app.
    • What about the Realm? This is by default the same value as FarmID. If i migrate this value, i have to change the Realm in SharePoint 2016. Or should i create the TST with a new Realm and existing IssuerID?

1 Answer 1


Answering this question on my own:

  1. Still no documentation available. I think Microsoft completely missed that! All info is from my own trial-and-error. Follow it completely on your own risk!
  2. Service-Applications:

    • We didn't move Subscription-Settings-Service to the new farm. Reason is the Versions table in the according database. The Version row seems to contain a Update-Installation history of the specific farm. We didn't want to replace that in 2016 with the values of 2013.
    • AppManagementService had to be migrated. Without migration, we got the error App "i:0i.t|ms.sp.ext|<appid>@<realm>" is not available. when loading the app on the site. I think there is some important stuff in AM_AppPrincipals and AM_AppPrincipalAppInstances tables. Migration is done like most other Service-Applications:
      • Backup ServiceApplication-Database in old SQL-Server and restore to new SQL.
      • If exists: Delete existing AppManagementService in SP2016
      • Create new AppMgmt-Service with New-SPAppManagementServiceApplication -Name "<YourName>" -Database <YourRestoredDatabaseName> -ApplicationPool <YourAppPool>
      • Create Proxy with New-SPAppManagementServiceApplicationProxy -Name "<YourProxyName>" -ServiceApplication <YourAppManagementService>
  3. We found an interesting article related to Realm-Change when configuring SPO-Hybrid-Environment. The information there is highly useful, as it describes how a Realm-Change for existing High-Trust-Apps has to be handled.

    • Based on that article, we decided to keep the Realm from SP2013 in SP2016. So we copied the SP2013 Realm to our SP2016 environment with the Set-SPAuthenticationRealm cmdlet.
    • IssuerID remained the same, as it is defined inside the app
    • So we created the New-SPTrustedSecurityTokenIssuer with -RegisteredIssuerName <oldIssuerID>@<oldRealm>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.