SSRS and Managed Service Account - impossible to configure?

Question

We are trying to configure Reporting Services to use a Managed Service Account. The environment is:

Server: Windows 2008 R2 SP1 Reporting Services: SQL Server 2012 (version 11.0.6567.0)

Currently, SSRS runs as a domain service account, but we would like to change to running as an MSA. The SQL Server instance and agent have both been successfully changed to use an MSA.

When I try to change the service account to an MSA, via Reporting Services Configuration Manager, I receive an error:

Microsoft.ReportingServices.WmiProvider.WMIProviderException: The account name is not valid. Specify an account in the form domain\alias.

---> System.Runtime.InteropServices.COMException (0x8004021D): Exception from HRESULT: 0x8004021D --- End of inner exception stack trace --- at Microsoft.ReportingServices.WmiProvider.RSWmiAdmin.ThrowOnError(ManagementBaseObject mo) at Microsoft.ReportingServices.WmiProvider.RSWmiAdmin.SetWindowsServiceIdentity(String accountName, SecureString password, Boolean useBuiltinAccount) at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.SetWindowsServiceIdentity(String accountName, SecureString password, Boolean useBuiltinAccount)

My question is simple:

Has anyone successfully changed the SSRS service account to use a Managed Service Account? If so, how?!

Answer 1

Yes you can run SSRS with a Managed Service Account.

I would double check that your MSA is installed on your SSRS server. You can do so with Powershell.

Get-ADServiceAccount -identity msaname -properties hostcomputers |select hostcomputers

If your SSRS server is not listed, you will need to install the MSA on the server. This needs to be run locally (on SSRS server). You MUST be domain admin to run Install-ADServiceAccount successfully.

Install-ADServiceAccount msaname

Answer 2

To add to the answer in Configuring SQL Server to use Managed Service Accounts (in PowerShell) by Robin Watkins, there is a 5th option (if you get up to Windows 2012 and your AD level is on Windows 2012), for the service account: Group Managed Service Accounts.These work for clustered instances.

BOL says:

The group Managed Service Account provides the same functionality (As the MSA) within the domain but also extends that functionality over multiple servers. When connecting to a service hosted on a server farm, such as Network Load Balance, the authentication protocols supporting mutual authentication require that all instances of the services use the same principal. When group Managed Service Account are used as service principals, the Windows operating system manages the password for the account instead of relying on the administrator to manage the password

Emphasis is my own.

Answer 3

I had similar issue before.

I had all SQL Services that I needed running on MSA or gMSA except for Reporting Services (SSRS); this stayed this way on Windows 2008 R2 and 2012. This issue went away when moved to Windows 2012 R2. In my experience, SSRS was the only service that would not run on MSA or gMSA on OS prior to Windows 2012 R2 but the database, analysis, agent, and integration services all worked ok with them even when not officially supported (MSA running with SQL Server 2008 R2).

At this link, https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions#MSA, it states:

To use a group managed service account for SQL Server 2014 or later, the operating system must be Windows Server 2012 R2 or later.

While it doesn't specifically state anything, something changed in the Windows 2012 R2 OS that allowed using MSA or gMSA for SSRS and I'm assuming it's related to the quote above. I just ran into a similar situation a few months ago during an upgrade/migration to SQL Server 2016. The original OS was running Windows 2012 and I tried everything I could to make it work but it never worked with SSRS until OS changed to Windows 2012 R2.

Answer 4

gMSAs

gMSAs are not officially supported to be used as a report server service account at the time of writing (19 September 2022). They can only be used at own risk.

This is noted in the documentation on SSRS:

Configure the Report Server Service Account (Report Server Configuration Manager):

Group Managed Service Accounts (gMSAs) are not supported as a report server service account.