Authorize attribute vs authorization node in web.config

I know I can restrict the access to an ASP.NET MVC 3 application using the authorization tag in web.config

   <authentication mode="Windows"></authentication>
    <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" />
    <authorization>
      <allow roles="MyDomain\MyGroup" />
      <deny users="*" />
      <deny users="?" />
    </authorization>

or decorating the controller base class with an [Authorize()] attribute (or even with a custom Authorize attribute)

[AdminOnly]
public class BaseController : Controller{}

The question is: are they alternative and equivalent approaches? Should I always use one approach rather than the other? Which elements should I keep in mind?