My reply got cut off somehow (second to last paragraph)…
I also had to enable anonymousAuthentication and disable windowsAuthentication in the web.config file of the Compliance service, which is how authentication is configured in the web.config file of the Pull service.