Share via

SharePoint Server custom workflow fails after farm changes

Von Mastein Jr 20 Reputation points
2026-03-11T11:49:07.6733333+00:00

In a SharePoint Server farm integrated with Workflow Manager, several SharePoint Designer workflows fail to transition beyond the “Starting” state when triggered on lists. The workflows previously executed successfully but recently stopped progressing without modifications to the workflow definitions.

One thing I felt so strange that Workflow Manager and Service Bus services are running, but ULS logs contain intermittent warnings related to workflow host communication and OAuth token validation. Restarting services does not consistently resolve the issue.

So in this situation, from a break-fix perspective, which technical checks should be prioritized ?

Regards

Microsoft 365 and Office | SharePoint Server | For business
0 comments
Answer accepted by question author
  1. Kudos-Ng 14,515 Reputation points Microsoft External Staff Moderator
    2026-03-11T13:55:26.11+00:00

    Hi Von Mastein Jr,

    Thank you for providing those specific details. 

    Workflows stuck in the "Starting" state, accompanied by "OAuth token validation" and "workflow host communication" warnings in ULS, typically indicate a breakdown in the trust relationship between SharePoint and the Workflow Manager (WFM) farm.

    Since this occurred after "farm changes", it is highly likely that the Secure-to-Secure (S2S) trust or the certificate thumbprint metadata has become stale or invalid.

    I regret to inform you that this is a user-to-user support forum. Moderators, contributors, and external Microsoft employees participating here do not have access to backend systems as well as a dedicated environment to reproduce your issue. Therefore, the following steps are searched and compiled by me from reported issues, requests, or ideas from the community or official documents:

    1. Check for Expired Workflow Manager Certificates

    Auto-generated WFM certificates typically expire after 5 years. If your farm reaches this age, the trust will break silently.

    • On the Workflow Manager server, run: Get-WFAutoGeneratedCA | Select NotAfter
    • If it has expired, you must regenerate the certificates and re-import the new Root CA to the SharePoint farm's Trusted Root store.

    2. Verify Workflow Service Application Connectivity

    • In Central Administration > Manage Service Applications, select the Workflow Service Application Proxy.
    • Confirm it displays "Workflow is Connected". If it shows "Not Connected," the pairing has been lost.

    3. Refresh Security Token Metadata

    Oftentimes, SharePoint simply has old certificate data in its cache.

    • In Central Administration > Monitoring > Review Timer Jobs, search for and run the "Refresh Trusted Security Token Services Metadata feed" job immediately.
    • This job updates the thumbprints used to validate tokens.

    4. Re-pair the Workflow Service

    If the above steps fail, you may need to force a re-registration using the SharePoint Management Shell:

    Register-SPWorkflowService -SPSite "https://your-site-url" -WorkflowHostUri "https://wfm-server:12290" -AllowOAuthHttp -Force

    (Note: Only use -AllowOAuthHttp if your WFM is configured over HTTP)

    I hope this helps you narrow down the cause.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.