vCenter SSO AD Integration - every user in domain can logon to vSphere Web Client?

Dear Forums,

we just installed a virtual Center applicance (6.0) and integraded SSO in Active Directoy using the "Integrated Windows Authentication". I see that now every user in the Domain can logon to the vSphere web Client (although they cannot modify or view any Settings). Is this normal behaviour? I would have expected that even the right to logon to the Web Client Needs to be explicitly set.

Thanks,
Michael