Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My organization has been using Active Directory groups to handle permissions to simple business applications, folders, and SQL Server objects. A coworker has been suggesting that we use Microsoft's AZManager to handle this kind of thing, but I don't really understand what this tool does that AD groups do not and he isn't sure either.

I understand from the documentation that AZManager does integrate with AD, but is there anything that it offers that AD doesn't already do? Am I mistaken in thinking that we won't need it?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Authorization Manager provides an abstraction layer between the generic concept of, "I want this group to be able to do this thing," and the discrete set of permissions required to make that happen. Roles are defined in the product as the permission sets required for that role. When groups are added to roles it assigns that group the role's permissions (which can be done a number of ways). This is how it simplifies managing permissions. In order to do this it has to run as a high level user.

In essence, it isn't any better than straight up AD permissions. It just simplifies assigning complex permissions.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.