In ASP.Net what is the difference between Authentication in IIS and in web.config

Question

I worked on a ASP.Net MVC 5 web application.

My web application is using Windows authentication, and I created a virtual directory to the web application on IIS.

There is an Authentication icon to configure the authentication via IIS, and it contains:

• Anonymous Authentication: Enabled.
• ASP.NET Impersonation: Disabled.
• Forms Authentication: Disabled.

So where is the Windows authentication?

Now in web.config in find:

<authentication mode="Windows" />
<authorization>
   <!--<deny users="?" /> i know that to deny Anonymous -->
</authorization>

So what is the difference between the authentication settings in IIS and authentication in web.config ? I can do what I want using web.config so why the IIS authentication configurations?

Answer 1

you can add/remove some security features in the add enable/disable windows features in the control panel at the IIS section:

Now, when you change the authentication type in the IIS, those changes are persisted in the web.config file, for windows authentication the option is basic authentication:

PD: My OS is in spanish, so sorry for that.

Regards,