We have two farms, one dedicated crawl farm and one that hosts content.

We have two SSAs(SSAWebApp1 & SSAWebApp2) on the crawl farm, one for each web app(WebApp1 & WebApp2) on the content farm.

We want to setup the search center in WebApp1 to return results from both SSAs. However, when attempting to return results from the SSAWebApp2 we get 401 unauthorized. This is while using the farm service account.

I have already established the trust between farms. The SSAs both crawl content fine. From WA1 search returns results for WA1 without issue, and from WA2 search returns results for WA2 without issue. For troubleshooting purposes we even gave everyone full control over the published SSAs.

What is causing our 401 unauthorized errors?

1 Answer 1


The Web App is bound to a Single SSA based on the Web Application Service Connection. It should only query one query instance. One thing to be very careful of is how you set up your SSAs, the whole topology should be on separate servers, otherwise the Query and Site Setting Service and Query Services can get confused causing users to get random 401s.

I am curious why you decided on 2 SSAs. What is the business requirement that drove you to this architecture?

  • The customer wanted to keep the two SSAs separate because of the nature of the data and to keep the indexes smaller for faster query times. Its interesting you say that about the topology on separate servers, since i have the topology set to be on a single server per SSA yet sharepoint insists on creating the IIS App pools for both SSAs on both servers in the crawl farm. And heaven forbid if i should delete the app pools on the server the topology isnt set on.
    – Semada
    Aug 23, 2018 at 1:05
  • Personally I would revisit the clients understanding of the "nature of the data" and how to segregate data in a single index with Security and Result Sources. I think two SSA'a in a single farm is a mistake. Aug 24, 2018 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.