I used to impersonate in ASP.NET to run the web application as system administrator to let the application work with system methods like creating subdomains by command below in web.config:

<identity impersonate="true" userName="administrator" password="MyPassword" />

Since I switched the app to the ASP.NET Core 3.1 and seems it doesn't support impersonate command as in ASP.NET classic, how I can do this? I have read that the way is to give NETWORK USER permission to iis settings folder to let the app edit the iis settings - and it worked perfectly - but I am so worried about security because now each website in this server can do the same WITHOUT knowing system administrator account and can change the iis settings and remove the other websites easily.

let me know if any other solution to give this specific website the permission like this not all the websites.