Implement and manage the Network Policy and Access Services role

Deploy and Configure NPS for Hybrid Azure Authentication

What NPS Does in Hybrid Environments

Network Policy Server (NPS) is a Windows Server role that handles three main jobs: checking who is trying to connect (authentication), deciding what they are allowed to do (authorization), and enforcing rules about how devices can join the network. In hybrid Azure environments, NPS works as a RADIUS server, which means it receives connection requests from network devices like VPN servers and wireless access points, then decides whether to allow or deny access based on policies. This setup lets organizations use their on-premises Active Directory together with cloud-based Azure services, so users can authenticate using the same credentials whether they are in the office or working remotely.

Setting Up Users for MFA

Before the NPS can require multifactor authentication, each user must first be registered for Microsoft Entra multifactor authentication (MFA). The registration process starts when users sign into the MFA setup portal, where they choose a verification method such as receiving codes by SMS, using an authenticator app, or inserting a hardware token. Users need to complete this registration for both their test accounts and regular user accounts so that the MFA settings in Azure recognize them. Without this registration step, the NPS cannot challenge users for a second form of verification when they try to connect.

Installing the NPS Extension

The NPS Extension for Azure MFA lives on a separate server from the VPN access point, and it acts as a bridge between the on-premises NPS and the cloud-based Azure MFA service. To install it, administrators download the extension from the Microsoft Download Center, run the setup.exe file, and confirm that all prerequisites are met. After installation, a PowerShell script runs to create the necessary certificates and update service principals in Microsoft Entra ID, which allows the on-premises server to communicate securely with the cloud authentication service.

Customizing Authentication for Different UPNs

Organizations sometimes have on-premises user principal names (UPNs) that do not match their cloud UPNs, which can cause authentication failures. To solve this, administrators configure alternate sign-in IDs by modifying registry values under HKLM\SOFTWARE\Microsoft\AzureMfa. This registry path maps Active Directory attributes to the correct cloud identity so that users can authenticate regardless of which format their username uses. The same registry location also supports creating IP exceptions, which allow specific network resources to bypass MFA requirements by whitelisting their IP addresses, ensuring that critical services remain accessible even when MFA enforcement is active.

Why This Integration Matters

Combining NPS with Azure MFA and certificate-based authentication gives organizations three important benefits. First, it provides granular access control because policies can specify which users or groups can access which network resources under which conditions. Second, it strengthens security by requiring multiple forms of verification, which makes it much harder for attackers to use stolen credentials. Third, it improves operational efficiency because the PowerShell-based setup can be replicated across multiple servers quickly, making it easier to scale the solution as the organization grows. Together, these capabilities let hybrid organizations protect their network access while keeping the experience simple for legitimate users.