Creating New Service Application Proxy Groups and Associating Services and Sites

Sometimes the need arises to create separate Service Application Proxy groups in SharePoint. Starting with SharePoint 2010, you’ve been able to do this. In SharePoint 2007, you would have created different Shared Service Providers. Your needs might be, that you are exposing web applications to a different group of users, and need separate applications such as Search and the User Profile Service. This also allows you to run those service applications under different accounts, if you needed to for security reasons.

First, let’s create the proxy group we want to use. And lets give it a name.. in the example, I’ll be using "Redacted"… because all my screenshots have had the real service application group identity redacted 🙂 But you can name this anything you’d like. Load up the SharePoint Version Management Console… and call the New-SPServiceApplicationProxyGroup PowerShell cmdlet.

New-SPServiceApplicationProxyGroup "Redacted"

Once you have your new Service Application Proxy Group created, you can then change the web application subscriptions to the proxy groups. To do so, go into Central Administration > Application Management > Web Applications > Manage web applications and select one of your sites. In the ribbon, then select Service Connections under the Management group.

You can always verify this by then going into Central Administration > Application Management > Service Applications > Configure service application associations

Select the Web Applications view, and then you should see your sites, and their associated applications with their Application Proxy Groups.

When you create a new service application, by default, it is going to get tossed into the default group. There is no way in the UI presently to allow you to change associations in the UI once you have created your new proxy group, so, what you need to do is to handle this in PowerShell. The best way to get the IDs for your service applications is to use Get-SPServiceApplication, and then only display the two columns you need, DisplayName (so you know what ones you are looking for), and the Id.

Get-SPServiceApplication | select-object DisplayName,Id

Once you have the ID’s that you need for your Service Applications, you now need to add them as members to the new proxy group you created earlier. You can do this by using the Add-SPServiceApplicationProxyGroupMember PowerShell cmdlet, like so:

Add-SPServiceApplicationProxyGroupMember "Redacted" -Member "f166672c-24b5-4f1a-bd2d-e8436d966abb"

This will add the "Secure Store Service – Redacted" Service Application to my new proxy group Redacted.

If for some reason, one of the service applications do not want to move out of the default group after adding them into the new group, you can remove them with the Remove-SPServiceApplicationProxyGroupMember PowerShell cmdlet. Just an FYI – the default group is referenced as "", so, if you needed to now remove the above service from the default group, you will need to address it as:

Remove-SPServiceApplicationProxyGroupMember "" -Member "f166672c-24b5-4f1a-bd2d-e8436d966abb"