Techie BabajiLearn to Code. Build Real Skills.
IIS (Internet Information Services) · Sites & App Pools

Application Pool Identity

Every worker process runs as a Windows account. That identity decides which files, folders and databases your app can reach.

Beginner 5 min Lesson 8 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:Application Pools
0/33 in IIS
On this page · 5 min · Beginner

On this page

  1. In simple words
  2. Learning objectives
  3. Explanation
  4. Code example
  5. Step by step
  6. Real-world use
  7. Common mistakes
  8. Best practices
  9. Remember this
  10. Practice exercise
  11. Mini quiz
  12. Related topics
  13. My notes
Reading time
5 min
Difficulty
Beginner
Updated
Oct 30, 2026

Related tutorials

Interview questions

In simple words#

The app pool identity is the ID badge the kitchen team wears. The badge decides which store rooms (folders) and lockers (databases) they can open. ApplicationPoolIdentity gives each team its own minimal badge.

ApplicationPoolIdentity
Default virtual account: IIS AppPool\PoolName.
LocalSystem
All-powerful account — avoid.
Custom account
A domain/service account, e.g. for network shares.

Learning objectives#

  • Explain the identity options
  • Grant folder permissions to a pool identity
  • Grant SQL Server access to a pool
  • Choose identities safely

Explanation#

ApplicationPoolIdentity (default) creates a virtual account per pool named IIS AppPool\PoolName. It has few rights — that is good.

NetworkService and LocalService are shared built-in accounts; LocalSystem has full control of the machine and should not run web apps.

Grant only what the app needs: read on the site folder, modify on folders it writes to (uploads, logs).

For SQL Server on the same machine, create a login for IIS AppPool\PoolName. For other machines, use a domain account (or gMSA) or SQL authentication from a vault.

Code example: Permissions for the ShopPool identity#

PowerShellPermissions for the ShopPool identity Illustrative
# Read & execute on the site, modify on the uploads folder
icacls "C:\inetpub\shop" /grant "IIS AppPool\ShopPool:(OI)(CI)RX"
icacls "C:\inetpub\shop\uploads" /grant "IIS AppPool\ShopPool:(OI)(CI)M"


# SQL Server on the same machine (run in SSMS):
# CREATE LOGIN [IIS AppPool\ShopPool] FROM WINDOWS;
# USE ShopDB; CREATE USER [IIS AppPool\ShopPool] FOR LOGIN [IIS AppPool\ShopPool];
# ALTER ROLE db_datareader ADD MEMBER [IIS AppPool\ShopPool];
# ALTER ROLE db_datawriter ADD MEMBER [IIS AppPool\ShopPool];


# Connection string then uses Windows auth:
# Server=localhost;Database=ShopDB;Integrated Security=True;TrustServerCertificate=True
Expected output
processed file: C:\inetpub\shop — the app can read its files, write uploads, and query ShopDB without any password in configuration.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. (OI)(CI) applies the permission to files and subfolders.
  2. RX = read & execute; M = modify.
  3. The SQL login is created for the pool’s virtual account.
  4. The connection string uses Integrated Security — no password.

Real-world use case#

A security audit passes because every app runs as its own pool identity with only the permissions it needs.

Common mistakes#

Running pools as LocalSystem to “fix” access denied

A compromised app would own the server. Grant the specific permission instead.

Granting Everyone full control

Use the pool identity and the least permission needed.

Best practices#

  • Keep ApplicationPoolIdentity by default
  • Grant least privilege with icacls
  • Use gMSA/domain accounts for network resources
  • Never use LocalSystem for web apps

Remember this#

Default identity = IIS AppPool\PoolName.

Grant RX for the site, M only where it writes.

Never LocalSystem.

Practice exercise#

Your task: Grant ShopPool read access to D:\shared\media.

Show solution
PowerShell Illustrative
icacls "D:\shared\media" /grant "IIS AppPool\ShopPool:(OI)(CI)R"

Mini quiz#

Application Pool Identity quizMultiple choice Question 1 of 1

What is the Windows account name for ApplicationPoolIdentity of a pool called ApiPool?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.