


Only supported URL Rewrite rules for SharePoint Server 2016 are used to remove a request header value. To work around this issue, disable OPTIONS requests for the affected web applications, and then use the URL Rewrite rules to effectively remove the Authorization: Bearer header from HEAD requests.

SharePoint Server 2016 sends an HTTP 401 authentication prompt because of an issue in the way that SharePoint Server 2016 on-premises handles requests that have the Authorization: Bearer header, and also because of the absence of the X-IDCRL_ACCEPTED: t header. Office applications send an Authorization: Bearer header for compatibility with SharePoint Online and OneDrive for Business. When you open documents in SharePoint Server 2016 by using Windows Installer (MSI) based version of Office applications, you are prompted for credentials if the conditions in the "Applies to" section are met. Accessing Office documents by using a different account than the one that you used to logged in to Windows.Anonymous access that is enabled for the SharePoint site or library.Windows Installer (MSI) based version of Microsoft Office 2016 applications (does not apply to Office 365 applications).
