Plan for administrative and service accounts in SharePoint Server

APPLIES TO: 2013 2016 2019 Subscription Edition SharePoint in Microsoft 365

To install SharePoint Server, you have to have appropriate administrative and service accounts on servers running SharePoint Server and SQL Server. After installation, you need to have appropriate administrative and service accounts to modify and maintain the environment. The accounts that you require to complete these groups of tasks are not necessarily the same. This article describes the accounts that you require after installation for a single-server environment and a server farm environment.

Use this article along with Initial deployment administrative and service accounts in SharePoint Server.

The initial deployment administrative and service accounts article describes the specific account and permissions that you need to grant prior to running Setup.

This article does not describe the account requirements for using Secure Store service in SharePoint Server. For more information, see Plan the Secure Store Service in SharePoint Server.

Learn About the SharePoint admin role in Microsoft 365.

This section lists and describes the accounts for which you must plan to manage servers running SQL Server or SharePoint Server. The accounts are grouped according to scope.

After you complete installation and configuration of accounts, ensure that you do not use the Local System account to perform administration tasks or to browse sites.

The following table describes the accounts that are used to configure SQL Server database software and to install SharePoint Server.

The following table describes the accounts that are used to set up and configure a service application.

For more information about service application endpoints, see Using Service Endpoints.

A single account should be used for all Web Applications, named Web Application pool account. This condition allows the administrator to use a single IIS Application Pool for all Web Applications, which increases performance and reduces memory usage on the server.

If you are deploying to a single server, account requirements are greatly reduced. In an evaluation environment, you can use a single account for all of the account purposes. In a production environment, ensure that the accounts that you create have the appropriate permissions for their purposes.

For a list of account permissions for single-server environments, see Initial deployment administrative and service accounts in SharePoint Server.

If you are deploying to more than one server, use the server farm standard requirements to ensure that accounts have the appropriate permissions to perform their processes across multiple computers. The server farm standard requirements detail the minimum configuration that is necessary to operate in a server farm environment.

For a list of standard requirements for server farm environments, see the requirements listed in the Technical reference: Account requirements by scenario section of this article.

For some accounts, additional permissions or access to databases is configured when you run the Configuration Wizard. These extra privileges are noted in the accounts planning tool. An important configuration for database administrators to be aware of is the addition of the WSS_Content_Application_Pools database role. The Configuration Wizard adds this role to the following databases:

• SharePoint_Config database (configuration database)

• SharePoint_Admin content database

Members of the WSS_Content_Application_Pools database role are granted the Execute permission to a subset of the stored procedures for the database. Additionally, members of this role are granted the Select permission to the Versions table (dbo.Versions) in the SharePoint_AdminContent database.

For other databases, the accounts planning tool indicates that access to read from these databases is automatically configured. In some cases, limited access to write to a database is also automatically configured. To provide this access, permissions to stored procedures are configured.

This section lists account requirements by scenario:

• Single-server standard requirements

• Server farm standard requirements