1. Create security groups for network controller management and clients.
✑ In Active Directory Users and Computers, create a security group for network controller management.
✑ In the group, add all the users who have permission to configure the network controller. For example, create a group named Network Controller Admins.
✑ All of the users that you add to this group must also be members of the Domain Users group in Active Directory.
✑ The group for network controller management should be a domain local group. Members of this group will be able to create, delete, and update the deployed network controller configuration.
✑ Create at least one user account that is a member of this group and have access to its credentials. After the network controller is deployed, VMM can be configured to use the user account credentials to establish communication with the network controller.
1. Create another security group for network controller clients
✑ Add users with permission to configure and manage networks using network controller. For example, create a group named Network Controller Users.
✑ All of the users that you add to the new group must also be members of the Domain Users group in Active Directory.
✑ All Network Controller configuration and management is performed using Representational State Transfer (DNS).
The group should be a Domain Local group. After the network controller is deployed, any members of this group will have permissions to communicate with the

network controller via the REST based interface.
✑ Create at least one user account that is a member of this group. After the network controller is deployed, VMM can be configured to use the user account credentials to establish communication with the network controller.
References:
https://docs.microsoft.com/en-us/system-center/vmm/sdn-controller?view=sc-vmm-1801
