Microsoft manages resource access with users and groups and an easy acronym to remember is  A-G-L-P. It works like this ...

[A]ccounts (users) go into Global Groups
[G]lobal Groups go into Domain Local Groups
Domain [L]ocal Groups are assigned [P]ermissions to resources.

Active Directory actually adds additional features to that rule but this gives you the idea.