Allowing restricted characters in URL

(IIS10)

I have a need to allow the & sign in the URL but it is part of a list of disallowed characters, giving me the error

"A potentially dangerous Request.Path value was detected from the client (&)"

After a lot of Google searching it looks like I need to modify the web.config, however I just can not seem to get it right, every time I try it just throws an error.

Could anybody help?