Setup: 2012 Server with IIS 8.5 hosting Sharepoint 2013 with the SP database hosted on a separate 2012 Server.

Whenever I disable Anonymous Authentication for the website in IIS, my SP site loses functionality to save properties/meta data for documents (i.e., Title, Security Attributes, other customized column data, etc.).

However, when I enable it I am able to return functionality to the site when uploading documents or modifying their properties.

Our security team is mandating that we disable this setting because its a CAT 1 STIG and needs to be closed.

I have scoured the interwebs looking for anything that states this setting is a must for Sharepoint 2013, but having much difficulty.

I am hoping that someone out there can provide some insight knowledge so I can justify this setting needing to be implemented.


You cant disable it as this functionality required for the claims based authentication. As you mentioned that when you disable it then you will lost the functionality.

The WCF runtime requires anonymous authentication for claims-based web applications.

SharePoint - Claims-based web applications require anonymous authentication in IIS

Also read this blog, which help you understand more.

Anonymous Authentication always on in SharePoint 2013

  • The link to "SharePoint - Claims-based web applications require anonymous authentication in IIS" no longer valid. For the 2nd link, the author seems not understand why MS disable it?
    – Mark L
    Mar 24 '20 at 5:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.