<system.web> <authorization> <allow roles="Admin" /> <deny users="?" /> </authorization> </system.web>