I had posted an earlier question regarding using FIM to provide a delegated adminsitration portal (add/modify/delete users - not just group membership) on the internet and was informed that it would not work - FIM was designed (tested) for internal use only. I have a slight variation to this, what if FIM was fronted by TMG and authenticated extranet users were given access to it. The other factor is that the extranet users are in a different domain than the internal users. Is this scenario supported? Thanks, BillBill