Windows Authentication in MVC4 with IIS Express

MVC4 gone through some major changes in Windows Authentication functionality with IIS Express. In this article you will learn how to enable Windows Authentication in MVC4 Web Application on IIS Express, just follow the given steps.

On Cassini web server it was quite difficult to test Windows Authentication as well as it doesn’t support SSL, URL Rewriting Rules etc. With IIS Express as your development server allows you to take full advantage of all web-server features (SSL, URL Rewrite Rules etc).  IIS is a full-fledged web-server – which means you’ll get an experience closer to what it will work like when you deploy the application on a production server.

Follow these steps to enable this in MVC4:

Step 1

Create an MVC Web Application preferably using Internet Application template or Intranet Application template.

Step 2

Open Web.config file and make following modifications:

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
<authentication mode="Windows" />

I just commented the Forms authentication and added Windows Authentication.

Step 3

By default MVC apps uses Form Authentication and Simple Membership, so you need to make it ‘false’ in order to run Windows Authentication.

  <add key="webpages:Version" value="" />
  <add key="webpages:Enabled" value="false" />
  <add key="PreserveLoginUrl" value="true" />
  <add key="ClientValidationEnabled" value="true" />
  <add key="UnobtrusiveJavaScriptEnabled" value="true" />

  <add key="autoFormsAuthentication" value="false" />
  <add key="enableSimpleMembership" value="false"/>

Step 4

Select project name in solution explorer and then in the property explorer, click to enable the Windows Authentication.

These settings are called development server settings works with IIS Express and they don’t make any changes in actual configuration settings.

Step 5

In the property explorer you can disable the Anonymous Authentication if you want your complete website for authenticated users on development server.

Step 6

If you already disabled the anonymous authentication as suggested in above step 5 you don’t need to do/repeat this step.

If you don’t, let’s go and make any controller action for authorized users, as given below.

Alternatively, you can use [Authorize] action filter with controller directly instead of individual action methods to make every action methods for authorize users.

Step 7

Notice, in above step I’m using [Authorize] action filter with ‘About’ action. So, when I hit about view page, I’ll be prompted to enter my windows credentials.

When I entered my credentials and hit Login. I will see my windows authentication working.

Step 8

Further reading, please watch this nice video by Shivprasad Koirala sir (Questpond)

Hope this helps.


  1. This helped me a lot, thanks

  2. How to Re-Authenticate it with different user name and password?

  3. This helped me a lot thank for the post

  4. I was tried it is not working is there any iis setting?


  5. Hi Selva what is the error you are getting

  6. Hi, till step 5 i have configured with Anonymous Authentication = disabled. But site does not prompt me user id and pwd.

    Also i want to sign in as different user , how is this posisble?

  7. Thanks for your post. This worked well for me.

  8. I must be missing something. To work like previous apps using windows authentication, you DON'T (or shouldn't) get prompted for credentials (that's the whole idea behind user-level security, right?). I do get prompted running locally under VS 2013 with IIS Express but don't remotely to the IIS server.


Post a Comment

Popular posts from this blog

Lambda two tables and three tables inner join code samples

Migrating database from ASP.NET Identity to ASP.NET Core Identity