Migrate Secure Store Service Application from SharePoint 2013 to SharePoint 2016

Migrate Secure Store Service Application

Whenever we migrate SharePoint from one version to the next version , we recreate most of the service applications. However, in few cases where we have dependencies with service applications like secure store and Managed metadata service which may have several credentials and term stores. recreating all the service IDs may be a tedious job and can easily land us in to issues. Hence, it is recommended to upgrade the Secure store service application. 

Title: Steps to Migrate Secure Store Service Application from SharePoint 2013 to 2016

In on of my SharePoint Migration Projects from SharePoint 2013 to SharePoint 2016 Secure Store Service Application was one of the critical services used by the customer due to its dependency with Data Refresh Jobs from SSAS. 

This article is a step by step approach to migrate Secure Store from SP 2013 to SP2016.

Steps:

Identify the Secure store database used in the SharePoint 2013 Database and restore a copy to the new SQL Server 2016 DB Server. 

Permissions: 

1.       Securityadmin fixed server role on the SQL Server instance for SharePoint Farm Setup account and SharePoint Farm Service account.

2.       Grant “DB_Owner” role on restored database for SharePoint Farm Setup account and SharePoint Farm Service account. 

Create Service Application:

1.       Login to Central Administration with the Farm Service Account.

2.       Go to Service Applications Page and Click New Secure Store Service Application.

3.       Fill the required data in the fields as per the instructions in the Service Application creation Page.

4.       In the “Database Name” field mention the Old Database Name that has been restored from SharePoint 2013 DB Server.

5.       Secure Store Application successfully created

6.       After creating the Secure Store Service Application, when we access it, it throws an error message “Unable to obtain the master Key”.

 Note: Master Key is the Passphrase used while creating the Secure Store Service in the Old SharePoint 2013 Environment

Upgrade Secure Store Service Application:

 1.       Launch CA with SharePoint Farm Service Account.

2.     Add SharePoint Farm Setup and SharePoint Farm service accounts as Administrators in the secure store service application.

3.      Launch SharePoint Management Shell with Farm service account and run the following command. This command updates and maps the old Passphrase to the Target Secure Store.

$SSSP = Get-spserviceapplicationproxy –identity ‘GUID’

Update-SPSecureStoreApplicationServerKey –Passphrase ‘Passphrase created for Old SecureStore’ –ServiceApplicationProxy $SSSP

4.   After running the above command all the secure store content along with the Power Pivot Data Refresh jobs related Service IDs are restored.