Configure Data Archive access

The account that PI Notifications Service uses must have read access to the necessary PI points on any Data Archive that the service accesses.

1. Use PI SMT to grant the PI Notifications Service account read access to the PIPOINT database on any Data Archive to which PI Notifications Service requires access:

   1. Create a new PI identity (Security > Identities, Users, & Groups).

      We recommend that an account being used for a service should only have the minimum required privilege, that is, the least required privilege. Therefore, administrative accounts or groups such as 'piadmin' or 'piadmins' should not be used as a service account.

   2. Give the identity read access to the PIPOINT database (Security > Database Security).

      For more information on access permissions for PI points, see the PI SMT topic PI point access permissions.

   3. Create a mapping between the PI identity and the account that runs the service (Security > Mappings and Trusts).

      If you are using the virtual account, you will need to use the PI AF server machine's computer account to create the mapping. See also the Microsoft article Understanding Computer Accounts.

   After you grant the PI Notifications Service account access to the PIPOINT database, the service will, by default, have the necessary access to all points subsequently created on that Data Archive server.

2. For any pre-existing points that you will use for notifications, make sure that the PI Notifications Service account has the following access permissions:

   PtSecurity	(r)
   DataSecurity	(r)

   You can use PI SMT or PI Builder to configure the point access for PI Notifications Service.