When we configure anonymous policy for a web application, there is an option for "deny all". Why is that?

We can just disable anonymous access, right?

Why would we enable anonymous access and use a "deny all" policy? Why would we use a "deny all" policy if the anonymous access is disabled?

2 Answers 2


Policy will change. Management will change. Everything will change. Deny all option give you a quick way to change back if necessary.


Deny All - Anonymous users cannot have any access, even if site administrators specifically attempt to grant the anonymous user account access to their sites.

For more information about it, see Manage permission policies for a web application in SharePoint 2013 and also Overview of security groups in SharePoint 2013

  • Please feel free to mark it as an answer, if it has helped you because it might help someone in future too :). For more information, please drop a comment. Jan 19, 2016 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.