IIS Default Proxy Credentials Can Use the Machine Account
Identify the network account behind default proxy credentials in an IIS worker rather than expecting the interactive administrator's identity.
Default proxy credentials in IIS belong to the worker's effective identity, not the administrator who deployed the application. NetworkService presents the computer's credentials remotely; application-pool identities also have documented machine-account behavior. In a suitable domain environment, the proxy can see DOMAIN\WEBSERVER$.
Record the application pool, its configured identity and any impersonation at the networking call. Compare that with the proxy's evidence for the same endpoint and challenge. A local pool-account name and the remote network identity are different observations.
If policy intentionally authorizes the machine account, grant that access deliberately. If a separate service account is required, supply it through the deployment's supported credential arrangement. Moving the whole pool to a privileged interactive account merely to reproduce a desktop success changes far more than the proxy login.
The authentication scheme must support the chosen identity. Default Windows credentials can participate in supported integrated authentication; they do not create a Basic username/password for an unrelated account.
Check route selection as well as credentials. A service may select another proxy configuration before authenticating. A 407 is useful only when attached to the worker's actual endpoint, account and advertised scheme.