By default, IIS is configured to block serving of .config files (among others) to prevent disclosure of security-sensitive information from the server. HTTP error codes of 401 (Unauthorized) or 404 are returned. For an application like an XBAP meant to be run on the client side, you need to change this setting to be able to use a .exe.config file. See http://msdn.microsoft.com/en-us/library/ms689460.aspx.