Microsoft NPS (Network Policy Server) is Microsoft’s implementation of a RADIUS server and proxy, built into Windows Server. It centralizes authentication, authorization, and accounting (AAA) for network access, checking user and device identity against Active Directory (AD) before allowing a connection. In practice, it is the access control policy decision point for network admission in Windows environments.
This guide explains what NPS is, how it works, where it is used, and the limitations that lead many teams to consider a cloud-native RADIUS service.
What Is Network Policy Server?
Network Policy Server is a role service in Windows Server that acts as a RADIUS server, a RADIUS proxy, or both. As a RADIUS server, it performs AAA for connection types that include wireless, wired, VPN, and dial-up. It is the successor to Internet Authentication Service (IAS), which shipped with Windows Server 2003 and earlier.
NPS sits between network access devices and the identity source. Access points, switches, and VPN servers are configured as RADIUS clients that forward authentication requests to NPS, and NPS validates those requests against an AD domain or the local user account database. When NPS is a member of an AD domain, it becomes part of a single sign-on setup, using the same credentials for network access and domain sign-in.
How Microsoft NPS Works
NPS makes access decisions by comparing each connection request against an ordered list of policies. The flow is consistent whether the request comes from Wi-Fi, wired, or VPN.
- A user or device connects through a network access device, which sends a RADIUS request to NPS with credentials or certificate data.
- NPS evaluates connection request policies to decide whether to process the request locally or forward it as a proxy.
- NPS checks network policies in order, matching conditions such as group membership, connection type, and/or time of day.
- On a match, NPS authenticates the identity, applies the policy settings, and returns an accept, along with any conditions such as a VLAN assignment.
- NPS logs the session for accounting and auditing.
RADIUS traffic uses UDP ports 1812 for authentication and 1813 for accounting. As a RADIUS proxy, NPS can forward requests and accounting data to a remote RADIUS server group, which is useful when authentication needs to reach another domain or service.
Authentication Methods NPS Supports
NPS authenticates 802.1X connections using Extensible Authentication Protocol (EAP) methods. The method you choose determines whether authentication relies on passwords or certificates.
| EAP method | How it authenticates | Passwordless | Notes |
|---|---|---|---|
| EAP-TLS | Client and server certificates, mutual | Yes | Strongest option, requires a PKI |
| PEAP-MSCHAPv2 | Username and password inside a TLS tunnel | No | Common but credential-based |
| EAP-TTLS | Credentials or other methods inside a TLS tunnel | Varies | Flexible tunneled authentication |
Certificate-based EAP-TLS offers the strongest protection because it removes passwords from the process, but it depends on a working certificate infrastructure. Password-based methods like PEAP-MSCHAPv2 are easier to set up but remain vulnerable to credential theft.
Common Use Cases for NPS
NPS is most often deployed to enforce network access in Windows and Active Directory environments. Three use cases cover the majority of deployments.
- Wireless 802.1X. NPS acts as the RADIUS server for WPA2-Enterprise and WPA3-Enterprise networks, authenticating users and devices before granting Wi-Fi access.
- Wired 802.1X. On managed switch networks, NPS provides port-based authentication so only authenticated devices reach the corporate LAN.
- VPN and network segmentation. Combined with network policies, NPS authenticates VPN connections and can place users into different VLANs or access levels based on group membership, device type, or connection method.
Benefits of Microsoft NPS
For organizations already invested in Windows Server and Active Directory, NPS offers clear advantages. It centralizes network policy and authentication in one place, which keeps access rules consistent across switches, wireless controllers, and VPN servers instead of scattering them across devices.
It integrates natively with AD, so it fits single sign-on environments without extra identity infrastructure. It is included with Windows Server, which means no separate license for the RADIUS role. Its accounting logs record connection times, source addresses, and session details, which supports auditing and incident investigation.
Limitations of Microsoft NPS
NPS was designed for on-premises Active Directory environments, and that shows as organizations adopt Microsoft Entra ID. Running NPS means maintaining Windows Server infrastructure, including redundancy for high availability, and integrating with Entra ID requires Active Directory, Microsoft Entra Connect, and the NPS Extension rather than a direct cloud-native integration. Microsoft’s strong certificate mapping requirement (KB5014754) also increased the operational complexity of certificate-based authentication. Policy processing adds further complexity, since each request can match only one connection request policy and one network policy, making policy order increasingly difficult to manage as deployments grow. None of these make NPS insecure, but they do make it more operationally complex in a cloud-first environment.
Modernizing RADIUS Beyond NPS
Organizations looking to modernize beyond NPS often adopt a cloud-native RADIUS service to eliminate Windows Server infrastructure while continuing to support standards-based 802.1X authentication. Portnox Cloud RADIUS integrates natively with Microsoft Entra ID, Okta, Google Workspace, and other identity providers, while supporting certificate-based authentication with EAP-TLS and modern authentication methods. As part of the Portnox Cloud platform, Cloud RADIUS can also leverage identity, device posture, and risk signals to make more informed authentication and authorization decisions. A local RADIUS instance provides authentication resilience if internet connectivity is temporarily unavailable.
Request a Demo to see how Portnox delivers cloud RADIUS and NAC without on-prem servers.
Frequently Asked Questions About Microsoft NPS
What is Microsoft NPS used for?
Microsoft NPS is used to centralize authentication, authorization, and accounting for network access in Windows environments. It acts as a RADIUS server or proxy for wireless 802.1X, wired 802.1X, and VPN connections, validating identities against Active Directory.
Is NPS the same as RADIUS?
NPS is Microsoft’s implementation of the RADIUS protocol, built into Windows Server. RADIUS is the protocol that defines centralized authentication and accounting, and NPS is one product that performs the RADIUS server and proxy roles for Windows and Active Directory environments.
What ports does NPS use?
NPS uses UDP port 1812 for authentication and UDP port 1813 for accounting, which are the standard RADIUS ports. Some older RADIUS deployments still use ports 1645 and 1646, so confirm the ports configured on your network access devices.
Does NPS work with Microsoft Entra ID?
NPS does not integrate natively with Microsoft Entra ID. It relies on on-prem Active Directory, so cloud identity requires directory sync and additional configuration, and multi-factor authentication depends on the NPS Extension rather than native support.
What are the main limitations of NPS?
NPS runs on Windows Server, so it requires on-prem maintenance and redundancy, lacks native cloud identity integration, needs the NPS Extension for MFA, requires strong certificate mapping for certificate-based auth, and matches only one connection and one network policy per request.