Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My organization has been using Active Directory groups to handle permissions to simple business applications, folders, and SQL Server objects. A coworker has been suggesting that we use Microsoft's AZManager to handle this kind of thing, but I don't really understand what this tool does that AD groups do not and he isn't sure either.

I understand from the documentation that AZManager does integrate with AD, but is there anything that it offers that AD doesn't already do? Am I mistaken in thinking that we won't need it?

share|improve this question
up vote 1 down vote accepted

Authorization Manager provides an abstraction layer between the generic concept of, "I want this group to be able to do this thing," and the discrete set of permissions required to make that happen. Roles are defined in the product as the permission sets required for that role. When groups are added to roles it assigns that group the role's permissions (which can be done a number of ways). This is how it simplifies managing permissions. In order to do this it has to run as a high level user.

In essence, it isn't any better than straight up AD permissions. It just simplifies assigning complex permissions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.