Configure Data Archive access

The account that runs PI Analysis Service must have read and write access to the necessary PI points on any Data Archive that the service accesses.

Note: If PI AF interacts with more than one Data Archive, you must repeat this procedure for each Data Archive.

1. Use PI SMT to grant the PI Analysis Service account read and write access to the PIPOINT database on any Data Archive to which PI Analysis Service requires access:

   1. Create a new PI identity (Security > Identities, Users, & Groups).

      We recommend that an account being used for a service should only have the minimum required privilege, that is, the least required privilege. Therefore, administrative accounts or groups such as 'piadmin' or 'piadmins' should not be used as a service account.

   2. Give the identity read and write access to the PIPOINT database (Security > Database Security).

      For more information on access permissions for PI points, see the PI Server topic PI point access permissions.

      Note: PI Analysis Service needs write access to PIPOINT database to create output PI points when they don't exist.

   3. Create a mapping between the PI identity and the account that runs the service (Security > Mappings and Trusts).

      If PI Analysis Service is using the virtual account, you will need to use the PI AF server machine's computer account to create the mapping. See the Microsoft article Service Accounts.

   After you grant the PI Analysis Service account access to the PIPOINT database, the service will, by default, have the necessary access to all points subsequently created on that Data Archive server.

2. For any pre-existing PI points you want to use for analysis input (all tags except those you specifically want to exclude), make sure the account that writes to the PI points (PI Analysis Service or PI Buffer Subsystem, if configured) has the following access permissions:

   PtSecurity	(r)
   DataSecurity	(r)

   You can use PI SMT or PI Builder to configure the point access for PI Analysis Service.

3. For any pre-existing points that you will use for analysis output, make sure that the account running PI Analysis Service has the following access permissions:

   PtSecurity	(r)
   DataSecurity	(r,w) Note: If buffering is configured, the PI Analysis Service account needs only read permissions on DataSecurity for analysis output tags.

   You can use PI SMT or PI Builder to configure the point access for PI Analysis Service.

   Note: PI Analysis Service does not use exception reporting while writing to output configured as PI point data references. Although exception settings for the output PI point are not used, compression settings for the output PI point will be used to determine the outputs that are written to Data Archive.