• We tend to use WA because we also use groups to control software installation. The fact is, if you're using WA everywhere else, why change it. WA plus app roles provides enough control for us. Also, what about the transaction log? How do you know who's performing which transactions if you use a "service id"?