Management Authorization Rules <authorizationRules>


The <authorizationRules> element of the <authorization> element specifies which IIS Manager users and Windows users are authorized to connect to a site or an application by using IIS Manager when the default authorization provider, ConfigurationAuthorizationProvider, is enabled in Internet Information Services (IIS) 7.

Note: The ConfigurationAuthorizationProvider uses the IIS Administration.config file to store IIS Manager authorization settings for IIS Manager; however, other authorization providers may use alternate storage locations.


Version Notes
IIS 7.5 The <authorizationRules> element was not modified in IIS 7.5.
IIS 7.0 The <authorizationRules> element of the <authorization> element was introduced in IIS 7.0.
IIS 6.0 N/A


The default installation of IIS 7 does not include the Management Service role service. To install this role service, use the following steps.

Windows Server 2008 or Windows Server 2008 R2

  1. On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
  2. In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
  3. In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
  4. On the Select Role Services page of the Add Role Services Wizard, select Management Service, and then click Next.

  5. On the Confirm Installation Selections page, click Install.
  6. On the Results page, click Close.

Windows Vista or Windows 7

  1. On the taskbar, click Start, and then click Control Panel.
  2. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
  3. Expand Internet Information Services, then Web Management Tool.
  4. Select IIS Management Service, and then click OK.

How To

How to authorize an IIS Manager user for a site or application

  1. Open Internet Information Services (IIS) Manager:
    • If you are using Windows Server 2008 or Windows Server 2008 R2:
      • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
    • If you are using Windows Vista or Windows 7:
      • On the taskbar, click Start, and then click Control Panel.
      • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  2. In the Connections pane, go to the connection, site, application, or directory for which you want to authorize an IIS Manager user.
  3. In the Home pane, double-click IIS Manager Permissions.

  4. On the IIS Manager Permissions page, click Allow User... in the Actions pane.

  5. In the Allow User dialog box, choose IIS Manager, then click Select...

  6. In the Users dialog box, highlight the user account that you want to allow, and then click OK.

  7. In the Allow User dialog box, click OK.




Child Elements

Element Description
scope Optional element.

Configures the virtual path of the site or application to which IIS Manager users and Windows users are authorized to connect by using IIS Manager.

Configuration Sample

The following configuration sample shows how to authorize an IIS Manager user named Contoso, a Windows group named Test Group, and a Windows user named Contoso2 to connect to the Default Web Site by using IIS Manager.

   <scope path="/Default Web Site">
      <add name="Contoso" />
      <add name="COMPUTER01\Test Group" isRole="true" />
      <add name="COMPUTER01\Contoso2" />

Sample Code

The following code samples check to see if a <scope> element has already been added to the <authorizationRules> element for the Default Web Site; if not, a <scope> element is added the <authorizationRules> element. Next, an <add> element is added to the <scope> element that authorizes a user account named ContosoUser.


Note: You cannot configure <system.webServer/management/authorization> settings using AppCmd.exe.


using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
   private static void Main()
      using (ServerManager serverManager = new ServerManager())
         Configuration config = serverManager.GetAdministrationConfiguration();
         ConfigurationSection authorizationSection = config.GetSection("system.webServer/management/authorization");
         ConfigurationElementCollection authorizationRulesCollection = authorizationSection.GetCollection("authorizationRules");

         ConfigurationElement scopeElement = FindElement(authorizationRulesCollection, "scope", "path", @"/Default Web Site");
         if (scopeElement == null)
            scopeElement = authorizationRulesCollection.CreateElement("scope");
            scopeElement["path"] = @"/Default Web Site";

         ConfigurationElementCollection scopeCollection = scopeElement.GetCollection();
         ConfigurationElement addElement = scopeCollection.CreateElement("add");
         addElement["name"] = @"ContosoUser";


   private static ConfigurationElement FindElement(ConfigurationElementCollection collection, string elementTagName, params string[] keyValues)
      foreach (ConfigurationElement element in collection)
         if (String.Equals(element.ElementTagName, elementTagName, StringComparison.OrdinalIgnoreCase))
            bool matches = true;
            for (int i = 0; i < keyValues.Length; i += 2)
               object o = element.GetAttributeValue(keyValues[i]);
               string value = null;
               if (o != null)
                  value = o.ToString();
               if (!String.Equals(value, keyValues[i + 1], StringComparison.OrdinalIgnoreCase))
                  matches = false;
            if (matches)
               return element;
      return null;


Imports System
Imports System.Text
Imports Microsoft.Web.Administration

Module Sample
   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetAdministrationConfiguration
      Dim authorizationSection As ConfigurationSection = config.GetSection("system.webServer/management/authorization")
      Dim authorizationRulesCollection As ConfigurationElementCollection = authorizationSection.GetCollection("authorizationRules")

      Dim scopeElement As ConfigurationElement = FindElement(authorizationRulesCollection, "scope", "path", "/Default Web Site")
      If (scopeElement Is Nothing) Then
         scopeElement = authorizationRulesCollection.CreateElement("scope")
         scopeElement("path") = "/Default Web Site"
      End If

      Dim scopeCollection As ConfigurationElementCollection = scopeElement.GetCollection
      Dim addElement As ConfigurationElement = scopeCollection.CreateElement("add")
      addElement("name") = "ContosoUser"

   End Sub

   Private Function FindElement(ByVal collection As ConfigurationElementCollection, ByVal elementTagName As String, ByVal ParamArray keyValues() As String) As ConfigurationElement
      For Each element As ConfigurationElement In collection
         If String.Equals(element.ElementTagName, elementTagName, StringComparison.OrdinalIgnoreCase) Then
            Dim matches As Boolean = True
            Dim i As Integer
            For i = 0 To keyValues.Length - 1 Step 2
               Dim o As Object = element.GetAttributeValue(keyValues(i))
               Dim value As String = Nothing
               If (Not (o) Is Nothing) Then
                  value = o.ToString
               End If
               If Not String.Equals(value, keyValues((i + 1)), StringComparison.OrdinalIgnoreCase) Then
                  matches = False
                  Exit For
               End If
            If matches Then
               Return element
            End If
         End If
      Return Nothing
   End Function

End Module


var adminManager = new ActiveXObject("Microsoft.ApplicationHost.WritableAdminManager"); 
adminManager.CommitPath = "MACHINE/WEBROOT"; 
adminManager.SetMetadata("pathMapper", "AdministrationConfig");

var authorizationSection = adminManager.GetAdminSection("system.webServer/management/authorization", "MACHINE/WEBROOT"); 
var authorizationRulesCollection = authorizationSection.ChildElements.Item("authorizationRules").Collection;

var scopeElementPos = FindElement(authorizationRulesCollection, "scope", ["path", "/Default Web Site"]);
if (scopeElementPos == -1)
   var scopeElement = authorizationRulesCollection.CreateNewElement("scope");
   scopeElement.Properties.Item("path").Value = "/Default Web Site";
   var scopeElement = authorizationRulesCollection.Item(scopeElementPos);

var scopeCollection = scopeElement.Collection;
var addElement = scopeCollection.CreateNewElement("add");
addElement.Properties.Item("name").Value = "ContosoUser";


function FindElement(collection, elementTagName, valuesToMatch) {
   for (var i = 0; i < collection.Count; i++) {
      var element = collection.Item(i);
      if (element.Name == elementTagName) {
         var matches = true;
         for (var iVal = 0; iVal < valuesToMatch.length; iVal += 2) {
            var property = element.GetPropertyByName(valuesToMatch[iVal]);
            var value = property.Value;
            if (value != null) {
               value = value.toString();
            if (value != valuesToMatch[iVal + 1]) {
               matches = false;
         if (matches) {
            return i;
   return -1;


Set adminManager = WScript.CreateObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT"
adminManager.SetMetadata "pathMapper", "AdministrationConfig"

Set authorizationSection = adminManager.GetAdminSection("system.webServer/management/authorization", "MACHINE/WEBROOT")
Set authorizationRulesCollection = authorizationSection.ChildElements.Item("authorizationRules").Collection

scopeElementPos = FindElement(authorizationRulesCollection, "scope", Array("path", "/Default Web Site"))
If scopeElementPos = -1 Then
   Set scopeElement = authorizationRulesCollection.CreateNewElement("scope")
   scopeElement.Properties.Item("path").Value = "/Default Web Site"
   Set scopeElement = authorizationRulesCollection.Item(scopeElementPos)
End If

Set scopeCollection = scopeElement.Collection
Set addElement = scopeCollection.CreateNewElement("add")
addElement.Properties.Item("name").Value = "ContosoUser"


Function FindElement(collection, elementTagName, valuesToMatch)
   For i = 0 To CInt(collection.Count) - 1
      Set element = collection.Item(i)
      If element.Name = elementTagName Then
         matches = True
         For iVal = 0 To UBound(valuesToMatch) Step 2
            Set property = element.GetPropertyByName(valuesToMatch(iVal))
            value = property.Value
            If Not IsNull(value) Then
               value = CStr(value)
            End If
            If Not value = CStr(valuesToMatch(iVal + 1)) Then
               matches = False
               Exit For
            End If
         If matches Then
            Exit For
         End If
      End If
   If matches Then
      FindElement = i
      FindElement = -1
   End If
End Function
Deprecated Elements