I'm trying to configure PerformancePoint using this article and Analysis Services is running and configured on that box, but the constrained delegation won't let me choose the MSOLAPSvc.3 service because it's not there. My SPN's are as follows.

PerformancePoint Web application pool service account:

HTTP/webapplicationFQDN:port (port 80 is seperate and uses NTLM)

SQL Analysis Service account:


PerformancePoint Service Application Pool account:

SP/svcPPS (to open delegation)

Claims to Windows Token Service Application Pool account:

SP/C2WTS (to open delegation)

IIS settings: Kernel mode and EP off. Providers are: Negotiate first, NTLM second.

I am getting security logs that Kerberos is used successfully on the web application level, but using Kerberos for PerformancePoint i've read needs to have constrained delegation, and I can't select the MSOLAPSvc.3 service on the sqlserver, and therefore my dashboard designer will not connect to a test data source.

1 Answer 1


After 4 hours, I found you need to add the SPN of the service you want to use to the SERVER itself. Anything that is missing is not added to that server's SPN (not user account)

setspn -A MSOLAPSvc.3/serverFQDN server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.