Techie BabajiLearn to Code. Build Real Skills.
IIS (Internet Information Services) · Security

Authorization Rules

After IIS knows who the user is, authorization rules decide which paths they may access — without touching application code.

Intermediate 5 min Lesson 17 of 33Covers IIS 10 on Windows Server 2019/2022/2025 and Windows 10/11.
Before you start:Authentication
0/33 in IIS
On this page · 5 min · Intermediate

On this page

  1. In simple words
  2. Learning objectives
  3. Explanation
  4. Code example
  5. Step by step
  6. Real-world use
  7. Common mistakes
  8. Best practices
  9. Remember this
  10. Practice exercise
  11. Mini quiz
  12. Related topics
  13. My notes
Reading time
5 min
Difficulty
Intermediate
Updated
Oct 30, 2026

Related tutorials

Interview questions

In simple words#

Authentication is checking the visitor’s ID at the gate. Authorization rules are the signs on each door: “HR staff only”, “Managers only”, “No visitors”.

URL Authorization
IIS role service for allow/deny rules.
Allow / Deny
Rules for users, roles (groups) or verbs.
Order
Deny rules are evaluated first, then allow.

Learning objectives#

  • Install URL Authorization
  • Allow and deny users and groups
  • Protect specific paths
  • Know when to use app-level authorization instead

Explanation#

Install the URL Authorization role service (Web-Url-Auth).

Rules are added per site, application or path using <authorization> in web.config.

users="*" means everyone, users="?" means anonymous users. roles="CORP\HR" means a Windows group.

For business rules inside the app, prefer ASP.NET Core policies; use IIS rules to protect whole folders or static content.

Code example: Protect /reports for the HR group#

XMLweb.config Illustrative
<configuration>
  <location path="reports">
    <system.webServer>
      <security>
        <authorization>
          <remove users="*" roles="" verbs="" />
          <add accessType="Allow" roles="CORP\HR-Staff" />
          <add accessType="Allow" users="CORP\asha" />
          <add accessType="Deny" users="?" />
        </authorization>
      </security>
    </system.webServer>
  </location>
</configuration>
Expected output
Only members of CORP\HR-Staff and the user CORP\asha can open /reports; everyone else gets 401 Unauthorized.

This example is illustrative. Copy or download it and run it in your own environment; the expected output is shown above.

Step-by-step explanation#

  1. <location path="reports"> scopes the rules to that folder.
  2. <remove users="*"> removes the default “allow all” rule.
  3. Allow rules list the group and a specific user.
  4. Anonymous users are denied.

Real-world use case#

Generated PDF reports in a static folder are restricted to the HR group without adding code to the app.

Common mistakes#

Forgetting to remove the default Allow All rule

Inherited “allow *” keeps the folder open.

Relying on IIS rules for record-level security

Use application authorization for per-record checks.

Best practices#

  • Use groups, not individual users
  • Remove inherited allow-all
  • Test with a non-member account
  • Keep business rules in the app

Remember this#

* = everyone, ? = anonymous.

Remove the default allow-all first.

Folders → IIS rules; records → app logic.

Practice exercise#

Your task: Deny all anonymous users for the whole site.

Show solution
XML Illustrative
<system.webServer>
  <security>
    <authorization>
      <add accessType="Deny" users="?" />
    </authorization>
  </security>
</system.webServer>

Mini quiz#

Authorization Rules quizMultiple choice Question 1 of 1

In IIS authorization rules, what does users="?" mean?

Score so far: 0/0

Want more? Practise all IIS MCQs · IIS interview questions

My notes#

Saved in this browser.

Progress is saved in this browser. Sign in to sync.