Debugging IIS Express authentication issue

I've got an MVC webpage with Windows authentication where users log in using domain credentials. Here are my auth web.config settings:

<system.web>
    <compilation debug="true" targetFramework="4.6.1" />
    <httpRuntime targetFramework="4.5" maxQueryStringLength="32768" maxUrlLength="65536" />
    <customErrors mode="Off" />
    <authentication mode="Windows" />
    <authorization>
      <allow roles="NG\All-Trained-Users" />
      <deny users="*" />
    </authorization>
    <hostingEnvironment shadowCopyBinAssemblies="false" />
    <pages>
      <namespaces>
        <add namespace="System.Web.Helpers" />
        <add namespace="System.Web.Mvc" />
        <add namespace="System.Web.Mvc.Ajax" />
        <add namespace="System.Web.Mvc.Html" />
        <add namespace="System.Web.Optimization" />
        <add namespace="System.Web.Routing" />
        <add namespace="System.Web.WebPages" />
      </namespaces>
    </pages>
    <identity impersonate="true" />
</system.web>

However, access to shared resources is denied in the app.

• Users are prompted for Windows auth after the global.asax.cs Application_Start() method finishes. In that method, the app has access to shared resources. For example, Console.Writeline(Directory.Exists("\\existing\shared\directory")) prints "true". My understanding is the logged-in Windows user identity is being used to authenticate access -- right?
• I'm using the same credentials to log into Windows and to log into the webpage. However, when I log into the webpage, something changes, because Console.Writeline(Directory.Exists("\\existing\shared\directory")) prints "false" as the first line of the Index() method. Trying to access a file returns a System.UnauthorizedAccessException . Are those credentials treated differently within MVC?

System.Environment.UserName and System.Environment.UserDomainName return the same values in both Application_Start() and Index(). In File Explorer this user can navigate to the shared location and access files just fine. The network location lists the user as having access.

I've run out of places I know to look to fix this problem. I'm sure if I look in the right place it will show the wrong user or wrong domain or wrong authentication method, but I don't know where to look. Any hints for where I should go?