WebDAV drive mapping to SharePoint 2019 fails with "Access Denied"

Question

WebDAV drive mapping to SharePoint 2019 fails with "Access Denied"

Rada, Joyce Ann 41

Hi all,

We have SharePoint 2019 on-prem, with a zone that has ADFS (Trusted Identity Provider) authentication.

Browser access works fine (ADFS SSO).

But mapping a network drive to the same site (via WebDAV / "net use") fails with:

"Access Denied. Before opening files in this location, you must first add the web site to your trusted sites list, browse to the web site and select the option to login automatically."

This happens even with the site in Trusted Sites and WebClient service running.

My actual question: is this supposed to work at all in this setup?

WebDAV clients ("net use", "Map network drive") can't process ADFS redirects/claims, they only speak NTLM/Kerberos. So, I'm trying to confirm:

If Windows Auth is enabled on the same zone as ADFS, will WebDAV clients actually authenticate via NTLM/Kerberos and succeed, or does having ADFS on the zone break it regardless?
Is there a supported way to make WebDAV mapping work on a zone that also has ADFS, or does this fundamentally require a separate zone with only Windows Auth (no ADFS) to work reliably?
What other things should we check aside from from Trusted Sites and WebClient service?

We've noticed it works on some machines and not others under the same policy, which makes me think it's supposed to work via the NTLM path, but something client-side breaks it for some users. We even reproduced the failure by switching to a different Windows profile on a machine that otherwise maps fine, so it seems tied to the user session/auth negotiation, not the SharePoint zone config itself. Trying to confirm the "supposed to work" baseline before chasing individual machine issues further.

Thank you!

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @Rada, Joyce Ann

WebDAV mapping is generally not expected to work against a SharePoint zone that relies solely on ADFS authentication. The Windows WebDAV client is not designed to participate in the browser-based WS-Federation sign-in flow used by ADFS. SharePoint Server supports both Windows Authentication and Trusted Identity Provider authentication in claims-based web applications.

If Windows Authentication (Negotiate/NTLM) is enabled on the same zone, WebDAV clients may be able to authenticate through the Windows authentication path rather than being redirected to ADFS, depending on how authentication is negotiated by the client.

Based on the behavior you've described, where the same SharePoint configuration works for some user profiles but not others, this makes a client-side authentication issue more likely than a general SharePoint zone configuration issue, although additional investigation would be needed to confirm that.

In addition to confirming that the site is in the appropriate security zone and that the WebClient service is running, I recommend checking the following:

Whether Windows Authentication (Negotiate or NTLM) is enabled for the affected web application and zone.
Whether the failing client is authenticating through Windows Authentication or being redirected to ADFS.
Whether Enable Integrated Windows Authentication is enabled in Internet Options and Automatic logon is configured as expected.
Whether cached credentials in Windows Credential Manager differ between working and failing user profiles.
A network trace comparison between a working and failing profile to determine whether the authentication negotiation differs.

For environments that require browser access through ADFS as well as reliable WebDAV or Office integration, a common deployment approach is to provide a separate SharePoint zone that uses Windows Authentication only, while retaining the ADFS-enabled zone for browser access. This helps avoid authentication negotiation issues and client-dependent behavior.

Please note that this is a user-to-user community forum. We do not have access to your environment or Microsoft's internal systems, so we can only provide guidance based on public documentation and community experience. If you need confirmation on the supported behavior of WebDAV with ADFS and mixed authentication configurations in SharePoint Server, you may also consider posting in the Microsoft Community Hub where SharePoint administrators and subject matter experts may be able to share real-world deployment experience and implementation guidance.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.