We have recently migrated the SharePoint 2010 services to SharePoint 2016 using standard Microsoft SharePoint recommendations like content database backup and restore model. As part of it, we have migrated the Secure Store Service and Business Data Connectivity service.

External content types came across and they are working, however, whenever anyone tries to refresh the external content type from list's External Data column, it is saying "XX Item(s) could not be refreshed because you do not have permissions on the external content type".

I have verified all the configurations and permissions for BDC service and finally went to "Secure Store Service" and I am seeing "Unable to obtain master key" error message.

I do not know the old pass phrase to refresh the key. What is the right way to fix this problem?

What is the impact of creating a new "Secure Store Service"? What is the additional work that needs to be done if we create new secure store service?


1 Answer 1


I would reset the farm pass phrase. You can do so with the command:

Set-SPPassPhrase -PassPhrase $secureStringPhrase

After that you can reset the SSSA by generating a new key.

  • Thanks for the response. I know my SharePoint 2016 server pass phrase, so I believe I don't need to reset farm pass phrase. I do not know my secure store service pass phrase. What is the impact of generating the new key? what happens to the existing applications that were built using old key? Commented Jun 27, 2018 at 10:24
  • Have a look here: docs.microsoft.com/en-us/previous-versions/office/… Same rules still apply... Main Point from the link: If the master encryption key cannot be retrieved, the credentials in the secure store database cannot be decrypted and will be unusable. Any client application that relies on the secure store database will be unable to authenticate users. Commented Jun 27, 2018 at 11:07
  • Thanks for your reply. Can I generate the master key without resetting the SharePoint farm pass phrase? Commented Jun 28, 2018 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.