When you embed a website which will return 307 to a website which require Windows Authentication, Edge might not prompt for credentials. And we will see “Tracking Prevention blocked access for storage for "

Cause

When your proxy hostname is in the list of disconnect-tracking-protection /services.json, Edge will use private mode to access the webpage and then it will suppress WIA in 3rd party contexts.

Reference

• Seamless Single Sign-On – text/plain (textslashplain.com)
• 1154281 - BlockThirdPartyCookies policy suppresses Negotiate/NTLM Authentication in 3rd party contexts - chromium

Solutions

A few options to resolve this issue:

• Use a customized hostname instead of a hostname which is listed in disconnect-tracking-protection/services.json.
• Disable tracking prevention feature
• Set the prevention feature to Basic

Repro

1. Download Fiddler Auto Responder rules from NoCredentialDialogIssue.farx
2. Access NoCredentialDialogIssueNormalScenario and we will see the credential dialog.
3. Access NoCredentialDialogIssueAbnormalScenario and you will see no credential dialog and we will see error “Tracking Prevention blocked access for storage for " in F12 Console.

Notes

In this repro, we returned 307 to redirect to a proxy URL. In the abnormal scenario, the proxy URL is proxy.fb.com. And in normal scenario, the proxy URL is proxy.com. fb.com is listed in disconnect-tracking-protection /services.json. Then when we try to access proxy.fb.com, we will see below information in net-export log

 t=37 [st=0]        COMPUTED_PRIVACY_MODE
                    --> privacy_mode = "disabled"