Iis – How to use rewrite rules in iis and windows authenication

Hi I've got a server with iis, and I've made some rewrite rules for the project I'm working on.

They work fine, I've tested them on a development machine and they are all fine.
However on this machine we have windows authentication. This works fine on a 'normal' real page. The details are passed from chrome/ie (it's for an inhouse project so they are configured to pass the credentials automatically) and the page is displayed.

However if it trips into a rewrite rule it reasks for the username/password in the iis authenication required dialog.

The rewire rules are all for local pages.

<rule name="Workflow Form DNumber" stopProcessing="true">
                    <match url="(.*)/workflow-form-([0-9]+)-0-0-([a-z,A-Z,0-9]+)" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
                    <action type="Rewrite" url="qqqq.php?yyy={R:2}&amp;xxxx={R:3}" logRewrittenUrl="true" />
                </rule>

So how do I get it to behave and pass the credentials appropriately and display the page.

I'm using URL rewrite 2.0.

I've read around is ARR required?

What is it?