Decide every service application before the farm is built

A database attach to Subscription Edition carries the content and the databases of a few service applications, and nothing of the farm that ran them: "you upgrade only the content for your environment and not the configuration settings" (upgrade service applications, checked on 6 November 2026). Every service application on the old farm is built again or left behind, and the choice comes before the new farm exists: Microsoft tells you not to let the Farm Configuration Wizard configure the ones you will upgrade (create the farm, checked on 6 November 2026), and documents the order in which they come back.

Which of the old farm's service applications come back from their databases, which are created new, which are retired, and in what order does the new farm build them?

The decision this chapter leads to is a disposition for every service application on the old farm (upgrade, create new or retire), recorded with what the new farm needs from the old one and its place in the build order.

Which farms this chapter is for

A SharePoint Server 2016 or 2019 farm moving to Subscription Edition by database attach, as Chapter 23 sets out. Every database the new farm upgrades, service application databases included, must be at version 16.0.4351.1000 or higher, or the upgrade is blocked (overview of the upgrade process, checked on 6 November 2026). A move into SharePoint Online is a copy and follows Chapters 8 and 9.

Upgrade, create new or retire

Sources for the table: upgrade service applications (above), services upgrade overview, SharePoint Workflow Manager on a new farm, what is deprecated or removed and share service applications across farms, all checked on 6 November 2026.

Retire needs evidence: by default every web application uses the farm's default group of connections (service application connections, checked on 6 November 2026), so association is not use. We would retire a service only when the content shows nothing depends on it and its owner agrees in writing.

A farm that keeps hybrid (Chapter 25) has two of these decided for it: before it runs, the Hybrid Configuration Wizard checks that the App Management service instance, application and proxy and the User Profile application proxy are online (Hybrid Configuration Wizard, checked on 7 November 2026). Build both on such a farm, whatever else the table says about them.

What each upgraded database brings, in Microsoft's order

Sources for the table: upgrade service applications and services upgrade overview (above), copy databases to the new farm, configure the Secure Store Service, plan a BCS solution and Set-SPMetadataServiceApplication, all checked on 6 November 2026.

Microsoft states the dependencies: Managed Metadata before User Profile, both before Search (upgrade service applications), and both before "any My Sites" (services upgrade overview). It gives no reason for putting Secure Store first. We read one in the overview, which upgrades its data so that Business Connectivity Services connections "can work with existing passwords".

Record what no database carries

Read these on the old farm before it goes read-only.

• The Secure Store pass phrase. It "is not stored" (configure the Secure Store Service), and without it "you will not have access to the information in the Secure Store" (create the farm, above). Where nobody has it, that page says to refresh the key, but refreshing asks for the pass phrase too; Generate New Key re-encrypts under a new one (configure the Secure Store Service). We would run it on the old farm, after a backup, and record the new pass phrase before the copy.
• Each Managed Metadata connection's four settings: default store for keywords, default store for column specific term sets, content types from the hub, push-down of their updates. The connection is created new, so you set them again, as switches of New-SPMetadataServiceApplicationProxy (configure the Managed Metadata service, the cmdlet, both checked on 6 November 2026). Record the hub's address too: Set-SPMetadataServiceApplication -HubUri sets it, and changing it unpublishes every content type package unless -DoNotUnpublishAllPackages is given (Set-SPMetadataServiceApplication, above).
• User Profile synchronisation: each connection's domain, account, containers and filter, the mappings and the schedule. Microsoft's upgrade pages do not say whether these return with the Profile database, and we do not know: record them and compare. Imports through Microsoft Identity Manager continue only on MIM 2016 Service Pack 3, the release whose supported platforms list Subscription Edition; Active Directory Import reads "a single Active Directory forest only" (install MIM for User Profiles), both checked on 6 November 2026.
• Search and associations: which search component runs on which server and how the links database is partitioned, since the new topology is made "alike" the old one and its links database partitioned "the same way" (upgrade service applications); and the proxy group each web application uses, from Configure service application associations (service application connections).

Build them in that order

On the new farm, after Chapter 23's build and with the content copied:

1. Start the instances where you must. On MinRole servers, creating a service application "automatically starts the Service Instance"; on Custom servers you start them first, Search from PowerShell, since Central Administration cannot start it "unless a Search Service application already exists" (upgrade service applications).
2. Create the five in the table's order, each on its copied database. Secure Store then has its key refreshed and the old pass phrase restored with Update-SPSecureStoreApplicationServerKey; Microsoft does not say whether that cmdlet is the refresh, so rehearse it. User Profile takes a new synchronisation database, as the procedure says, though the services overview lists one among those upgraded.
3. Search last. You pause the old Search service application before copying its administration database, and while paused its index "isn't updated". The new one needs "a full crawl of the entire indexed corpus" once every content database is attached (upgrade service applications). Our scripts analysis covers the resume step, whose farm Microsoft does not name.
4. Then the rest: App Management over its restored database where 2013 workflows move, then Subscription Settings, Word Automation and Machine Translation from the old farm's settings, Machine Translation last, since it needs App Management started and Full Control of the User Profile service for its pool account (automated document translation, checked on 6 November 2026).
5. Check the connections. One created in PowerShell joins the default group only if "the default parameter is supplied" (service application connections):

# New farm, read only: one line per connection in the default proxy group.
(Get-SPServiceApplicationProxyGroup -Identity "").Proxies | Format-Table DisplayName, TypeName

Before the first web application, we would compare each upgraded service with the old one: target applications, BDC models, term store, profile count, search schema and result sources. The rest waits for the attach and Chapter 23's checks.

Out of scope

The farm, web applications and attach are Chapter 23; what search indexes, Chapter 11; add-ins, Chapter 18; sign-in and the People Picker, Chapter 21; the systems behind Business Data Connectivity and Secure Store, Chapter 22; hybrid, Chapter 25. Farm sizing, Project Server and Reporting Services in SharePoint mode are not covered. The Subscription Edition migration pack records each service application, its databases, its path and the settings to reapply.

Before you continue

• Every service application on the old farm, and each one consumed from another farm, has a disposition and a reason
• Each retirement has evidence that nothing uses it, and its owner's written agreement
• The Secure Store pass phrase is recorded, and restoring it was rehearsed
• The Managed Metadata connections and hub, the profile synchronisation, the search topology and the associations are recorded
• The five were created in Microsoft's order, none by the Farm Configuration Wizard, Search last
• Every connection is in its proxy group, and each upgraded service shows what the old one held, before the first web application

Download chapter 10 (PDF)Same text, same tables, same sources as this page.