As you know, you can set authorization settings in folders to further restrict users. What you cannot do is set the authentication element in folders. You can only specify the authentication element ONCE per application. Therefore, to change the authentication element for a Specific folder, you will need to configure that folder to be a virtual directory in IIS. I hope this helps!