When building modern applications, you have many security options. How do you authenticate, how do you authorize? How do you manage access to resources on behalf of your users? Do you have to integrate with corporate security systems, or do you want to support web identities like a Google ID? Which protocols do your customers support? How do you provision new users and grant access? You can build such systems on your own and take the risk of getting sucked into a complexity vortex while doing so. Or you use a third party service to encapsulate the technical details into a service that you simply use from your applications. Such a service is the Windows Azure Access Control Service. It provides security services to applications - in the cloud, on-premise or wherever you want. This talk explains what ACS is all about and how it works.