# Security based on role and AD

**URL:** <https://community.jenkins.io/t/security-based-on-role-and-ad/1952>\
**Category:** Using Jenkins\
**Created:** [March 29, 2022, 3:32pm UTC](https://community.jenkins.io/t/security-based-on-role-and-ad/1952 "2022-03-29T15:32:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aurelb](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@aurelb](https://community.jenkins.io/u/aurelb)\
**Post date:** [March 29, 2022, 3:32pm UTC](https://community.jenkins.io/t/security-based-on-role-and-ad/1952/1 "2022-03-29T15:32:13Z")

</div>

Hi,

I’ve got a problem implementing security and role on Jenkins 2.332.1.  
I would like to implement AD authentication and role based strategy.  
But when I remove Anonimous from global role I got error message telling acess denied, user is missing the global/read permission, but my user got the admin role.  
So it’s like my AD user is not recognized as member of jenkins.

So the only one solution is to remove the security in config.xml and go back to the original security level…

---

<div class="post-metadata">

**Author:** ![kon](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/kon/32/1197_2.png) [@kon](https://community.jenkins.io/u/kon)\
**Post date:** [March 30, 2022, 4:21pm UTC](https://community.jenkins.io/t/security-based-on-role-and-ad/1952/2 "2022-03-30T16:21:24Z")

</div>

The role-based authorisation strategy plugin is not yet compatible with matrix authorisation v3, which is required by the latest versions of the Azure AD plugin. [[JENKINS-67422] Role-strategy compatibility with matrix-auth 3.0 - Jenkins Jira](https://issues.jenkins.io/browse/JENKINS-67422)

If you use the Azure AD matrix authorisation strategy instead, then you can grant access on Jenkins items to Azure AD users and groups (both security groups and Microsoft 365 groups), although not yet to Azure AD application roles. These permissions on items are saved to the items themselves and cannot be centrally managed with regular expressions and Configuration as Code, like you could with the role-based strategy. I suppose they could be centrally managed with Job DSL, though.