Please ensure Javascript is enabled for purposes of website accessibility
Powered by Zoomin Software. For more details please contactZoomin

PI Web API

TABLE OF CONTENTS

Configure a gMSA for PI Web API

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
  • Last UpdatedNov 04, 2026
  • 2 minute read

The PI Web API Admin Utility requires a password when initially configuring a custom service account. Because the domain controller manages the password for a group Managed Service Account (gMSA), a gMSA cannot be configured through the Admin Utility during the initial setup.

After the initial configuration is complete, you can assign the gMSA to the PI Web API services outside the Admin Utility. When you run the Admin Utility again, it recognizes the configured account and does not require a password unless you change the account.

Use the following procedure to configure PI Web API to run under a gMSA:

  1. Run the PI Web API Admin Utility and complete the initial configuration using the default service account. This step performs the required initial configuration of the PI Web API instance.

  2. Verify the following:

    1. The gMSA exists

    2. The PI Web API host is permitted to retrieve the password for the gMSA.

    3. The Test-ADServiceAccount returns True for the gMSA on the PI Web API host.

  3. Run services.msc from a command prompt.

  4. Open the properties for the PI Web API service by right clicking on PI Web API Service > Properties.

  5. Select the Log On tab.

  6. Specify the gMSA as the service account. Make sure to include the trailing dollar sign ($) in the account name. For example:

    DOMAIN\svc-piwebapi$

  7. Apply the change and then restart the PI Web API service.

  8. Confirm that the password is successfully retrieved and the PI Web API service is running.

  9. Run the PI Web API Admin Utility again and confirm that the correct gMSA account is being used.

  10. Complete the remaining steps of the Admin Utility without changing the service account settings to allow the Admin Utility to finalize the changes.

  11. Verify that https://<host>/piwebapi responds and that authentication is successful.