 <p>It appears that in case of using impersonated async http calls via httpWebRequest</p> <pre><code>HttpWebResponse webResponse; using (identity.Impersonate()) { var webRequest = (HttpWebRequest)WebRequest.Create(url); webResponse = (HttpWebResponse)(await webRequest.GetResponseAsync()); } </code></pre> <p>the setting <code>&lt;legacyImpersonationPolicy enabled="false"/&gt;</code> needs also be set in aspnet.config. Otherwise the HttpWebRequest will send on behalf of app pool user and not impersonated user.</p>