Note: For detailed instructions how to restrict access to map services in ArcGIS Server, please check ArcGIS Resources - Restricting access to GIS web services and ArcGIS Resources - Editing permissions in Manager.
Out of the box, the published services hosted by ArcGIS Server are publicly available for everyone with knowledge of the web service's URL and network access to the ArcGIS Server. To restrict access to a service, you will need to specify which users are allowed to access that service.
Creating an account "user" as member of role "MyUser" in ArcGIS Server Manager
Restrict permissions for a map service in ArcGIS Server Manager
Configuring the user that has access to the service in WebOffice author