| Previous | Next |
| SEC_E_UNSUPPORTED_PREAUTH | SEC_E_BAD_BINDINGS |
SEC_E_DELEGATION_REQUIRED
SEC_E_DELEGATION_REQUIRED signals this condition: The requested operation requires Kerberos delegation, but the computer or user is not configured to allow it. A front-end service tried to use the client identity to reach a back-end service. Kerberos delegation requires specific account and service configuration; it cannot be inferred from successful first-hop authentication.
What to check
- Verify which service account runs the front end and which SPN identifies the back end.
- Review the Delegation tab for the front-end computer or service account, and confirm that the user is not marked as sensitive and cannot be delegated when delegation is required.
- For cross-domain designs, validate whether resource-based constrained delegation is needed instead of traditional constrained delegation.
Microsoft: Troubleshoot Kerberos constrained delegation
Looking for a different code? Search another status or error code.