In the same way that you can delegate control over Acitve Directory, Exchange, and other Microsoft servers, ISA also supports administrative delegation. By delegating control over your ISA server, you can specify the amount of control your IT staff has over the ISA server(s).

Configuring delegation is pretty straightforward, but before we get into that, lets look at the different levels of control available. ISA Basic Monitoring - This is the lowest level of permissions you can delegate and allows the user to monitor the ISA server and network activity, but the user cannot add/remove/modify the configuration. ISA Extended Monitoring - The next step up allows the user all the rights of the ISA Basic Monitoring user and adds the rights to configure logging and alerts as well as all other monitoring related tasks. ISA Full Administrator - A user with this priveledge has full control over the ISA server. By default the local administrator account has has this right, as well as the account used to install ISA Server 2004. To delegate administration, open the ISA Management MMC, expand the Configration node and under the General node click on Administration Delegation.

On the first screen of the wizard click Next. Now you can click Add and enter the name of the user or group as well as choose the level of permissions they will have.

Verify the users and permissions are correct before clicking Next.

Finally, verify all the changes about to be applied and click Finish.

If you wish to remove a user or group or change the level of permissions delegate, simply start the wizard again, select the user or group and then press the edit or remove button!