How to Configure Secure Store Service Application in SharePoint 2016 - Step by Step

Secure store service enables you to securely store credentials required for connecting to external systems and associating those credentials to a specific identity or group of identities.  Secure Store Service solves the problem of having to sign into many applications and entering different usernames and passwords. This is managed through the SharePoint central administration and keeps the credentials stored secure and safe within a secured storage. Secure Store Service was introduced as a replacement to Single Sign-On in MOSS 2007.

Purpose of secure store service in SharePoint 2013
Primary purpose of Secure Store Service is to maintain credentials for target applications on external systems. When we connect to external data sources, it needs to pass the user credentials like user name and password. These type of scenarios we can solve with configure an unattended service account for the external data access.

E.g. When you want to use external data, such as data from your other business applications, in SharePoint, you can use Business Connectivity Services (BCS) together with Secure Store Service. And, you can manage BCS and Secure Store right in the SharePoint central administration site. The external data source that you can connect to is called a Secure Store Target Application. BCS makes it possible for you to set up a connection to the Target Application, and the Secure Store enables you to manage the credentials that are required by the external data source.

SharePoint has its built-in services that can be supported through Secure Store Service. They are as follows:

• Excel Services
• Visio Services
• Business Connectivity Services
• PowerPivot for SharePoint
• PerformancePoint Service

How to Create Secure Store Service Application in SharePoint 2016?
Lets see how to create secure store service configuration SharePoint 2016 step by step.

• Go to SharePoint 2013 Central Administration >> Manage Service Applications
• In the Service Applications ribbon click on New button and then select Secure Store Service
• Enter a name for the Secure store Service Application, database Server and Database name details
  
• Scroll down and either choose an existing application pool or create a new application pool using the managed account. To run the application pool, you need a domain account. No specific permissions are required for this account. Click OK to create secure store service.
  
• Wait for the secure store service application created message.
  

Generate new key in Secure Store Service:
Secure Store Service requires a key/ pass phrase to encrypt-decrypt credentials. The first time you access the Secure Stored Service it will ask you generate a new encryption key. Before using the Secure Store Service to create target applications, you must provide it with a pass phrase.

• Go to Central Administration site >>  Application Management
• Service applications page, pick your newly created Secure store service application.
• Click on Generate New Key from the ribbon
• Enter the passphrase and click on OK to complete secure store service configuration. Remember it or save a in safe place to have access it when you need.
  

Now the error message that displayed on the secure store has gone and it should read something like there are no Secure Store Target Application.

Start the Secure Store Service Instance on the application server(s)
The next step is to start secure store service on the server if its not started already.

• Go to Central Administration >> System Settings >> Manage service on server (Under Servers).
• Select the application server >> Locate the Secure Store Service then click start next to it.

The next step is to create Target Application, which I'll explain in an another article.

Technet reference: Configure the Secure Store Service in SharePoint 2013