Creating a tenant's business organization, the admin and subscribing to a hosted sharepoint service works. We can't create a WSS site for that tenant. The error message says "HTTP 401 access denied". We can verify that on WSS Server in IIS logs. The account used to create the WSS site is the tenants admin. That looks strange as we thought it would be MPSPrivAcct-xxxxx. If we grant the admin access rights (farm admin) the creation of the site works and we can log on to the Sharepoint Site.

But we don't want to grant (manually!) all customers admin rights on the WSS Server. Any ideas?

 Full error messages please, and make sure you have the correct security set for the physical folders.

Jeff

### error message from sample provisionig ui
###
The request failed with HTTP status 401: Unauthorized.

### snippet from IIS log WSS Central Admin Site (failed attempt)
###
2009-08-11 12:40:02 <ip sharepoint server> POST /MPSSharePointAdminWS/SPAdminWS.asmx - 8080 - <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 2 5 15
2009-08-11 12:40:03 <ip sharepoint server> POST /MPSSharePointAdminWS/SPAdminWS.asmx - 8080 FIRSTCLASSEMAIL\admin11_ITeconEurope <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 5 0 1388

### access right of phys folder
###
C:\Program Files (x86)\Microsoft Hosting\Provisioning\SharePoint Provider\Web Service
 NT SERVICE\TrustedInstaller:(ID)F
 NT SERVICE\TrustedInstaller:(CI)(IO)(ID)F
 NT AUTHORITY\SYSTEM:(ID)F
 NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
 BUILTIN\Administrators:(ID)F
 BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
 BUILTIN\Users:(ID)R
 BUILTIN\Users:(OI)(CI)(IO)(ID)(special access:)
                               GENERIC_READ
                               GENERIC_EXECUTE
 CREATOR OWNER:(OI)(CI)(IO)(ID)F

### IIS rights
###
S10009\Sites\SharePoint Central Administration v3\MpsSharePointAdminWS

here's what I got so far:

- admin11_ITeconEurope is the tenant's admin.
- when I grant WSS farm admin right admin11_ITeconEurope it works.
- IIS log looks like this then

### snippet from IIS log WSS Central Admin Site (successful attempt)
###
2009-08-11 08:16:11 <ip sharepoint server> POST /MPSSharePointAdminWS/SPSiteDataWS.asmx - 8080 - <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 2 5 0
2009-08-11 08:16:11 <ip sharepoint server> POST /MPSSharePointAdminWS/SPSiteDataWS.asmx - 8080 FIRSTCLASSEMAIL\admin11_ITeconEurope <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 200 0 0 826
2009-08-11 08:16:14 <ip sharepoint server> POST /MPSSharePointAdminWS/SPAdminWS.asmx - 8080 - <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 401 2 5 0
2009-08-11 08:16:14 <ip sharepoint server> POST /MPSSharePointAdminWS/SPAdminWS.asmx - 8080 FIRSTCLASSEMAIL\admin11_ITeconEurope <ip MPS server> Mozilla/4.0+(compatible;+MSIE+6.0;+MS+Web+Services+Client+Protocol+2.0.50727.1433) 200 0 0 436