In previous IIS versions you had to control access via file system ACLs. This is tedious and there is no web interface to do it. With URL authorization, you can control access to URLs using the IIS User Interface or using web.config directly. Additionally, you can use non-windows identities, e.g. Membership users and roles provided by forms authentication.