Give each IIS application an appropriate process identity and explicit access to the resources it needs. A separate application pool identity helps isolate local resource permissions without creating a normal local user account for every pool.
IN THIS ARTICLE
01 Choose and configure the identity
- In IIS Manager, identify the pool used by the application. Use a separate pool where the site's security or lifecycle requirements call for independent management.
- Open Application Pools, select the pool and choose Advanced Settings.
- Under the process-model settings, open Identity. Use ApplicationPoolIdentity when it meets the application's requirements, or a deliberately managed service identity when a documented dependency needs one.
- Record any application-specific profile requirement. Do not enable broad privileges or change identity simply because an application has not yet been given access to its own directory.
- Plan the affected pool restart or recycle and check active requests before applying a change that interrupts the process.
02 Grant access to the correct resources
For local files, open the directory's Properties, Security and the permission editor. Select the local computer as the account-search location and enter the virtual identity in the form IIS AppPool\ExamplePool, using the actual pool name. Use Check Names to resolve it.
Grant read and execute access to code that the application should not modify. Grant write or modify access only to the specific upload, cache or log directories that require it. Review inherited permissions as well as the new explicit entry.
Also inspect Authentication at the site or application. Anonymous Authentication can use IUSR or the application-pool identity. Its Edit action lets you select the intended anonymous identity; changing the worker-process identity alone does not automatically change every request's access context.
03 Review network access separately
Application pool identities use the machine account when accessing network resources in the documented domain scenario. Local pool isolation therefore does not automatically create a distinct remote identity for each site. Use an appropriate service-account and remote-permission design when applications require separate access to a file share or SQL Server.
Common questions
Why is the pool identity absent from Local Users and Groups?
It is a virtual account associated with the pool, not a conventional local user record. Resolve it using the IIS AppPool\PoolName name.
Should I grant Full Control to the whole site?
Grant the required permission to the specific directory and identity. Verify a read-only page and an authorised write operation, then confirm unrelated site directories remain inaccessible.