It is considered a best practice to create separate ClickOnce deployments when configuration settings differ across OnBase User Groups. For example, your Human Resources users do not need to access the OnBase Client, but your Accounts Payable users do need access to the OnBase Client. In this example, you should create two deployments; one with the ability to launch the OnBase Client, and one without the ability to launch the OnBase Client.