<system.web> <authorization> <deny verb="GET" roles="Admin" /> <deny verb="POST" users="*" /> </authorization> </system.web>