Migrating from Microsoft NPS to Cloud RADIUS

Last fact-checked: July 10, 2026

Microsoft NPS (part of the NPAS role) is a RADIUS server that runs on Windows Server and authenticates against Active Directory. It works, but it is legacy: no native cloud identity, no built-in EAP-TLS certificate lifecycle, and a Windows Server you have to keep patched and available. IronWiFi replaces NPS WiFi authentication with a managed cloud RADIUS service that connects to Microsoft Entra ID, supports the same EAP methods (EAP-TLS, PEAP, EAP-TTLS), and migrates in about two hours. Pricing is published — from $13/AP + $6.50/user per month, $65/month per venue minimum ($50/month if paying annually). See pricing.

Why Teams Move Off NPS

NPS is dependable, but it shows its age. It only runs as a role on Windows Server, so its availability is your availability — you own the patching, the failover, and the domain-joined servers behind it. It authenticates natively against on-premise Active Directory, which is awkward as identity moves to Microsoft Entra ID. And it has no built-in certificate lifecycle: doing EAP-TLS properly means standing up and babysitting Active Directory Certificate Services separately.

Meanwhile Microsoft has spent years steering customers toward cloud identity. Keeping WiFi authentication pinned to a Windows Server role runs against that grain. For a full feature-by-feature breakdown, see our IronWiFi vs Microsoft NPS comparison.

What Changes When You Move to IronWiFi

Area	Microsoft NPS	IronWiFi
Where it runs	Windows Server role you maintain	Managed cloud, multi-region
Identity source	Active Directory (native)	Entra ID, AD, Okta, Google, LDAP, SCIM
EAP methods	EAP-TLS, PEAP, EAP-TTLS	EAP-TLS, PEAP, EAP-TTLS
Certificate lifecycle	Separate AD CS deployment	Cloud PKI + SCEP built in
Captive portal	Not included	Built in
Patching & failover	Your responsibility	Handled, automatic failover
Pricing	Included with Windows Server	Published, from $13/AP + $6.50/user/mo

How the Migration Works

Because NPS and IronWiFi both speak standard RADIUS, your access points do not care which one answers — you are just changing where they send requests. A typical cutover takes about two hours:

1. Create your IronWiFi tenant and connect your identity source (Microsoft Entra ID, Active Directory, or another supported IdP).
2. Recreate your NPS network policies as IronWiFi authentication rules — same EAP methods, same VLAN assignment logic.
3. Add your access points and controllers as RADIUS clients (200+ AP vendors including Cisco, Meraki, Aruba, UniFi, and Ruckus are supported).
4. Point one test SSID at IronWiFi and validate EAP-TLS/PEAP end to end.
5. Repoint the rest of your APs, then retire the NPS role.

If you rely on certificates, IronWiFi's Cloud PKI and SCEP replace the AD CS plumbing you would otherwise maintain, so EAP-TLS no longer means running your own certificate authority.

What You Keep

• The same 802.1X, WPA2/WPA3-Enterprise WiFi your users already connect to
• The same EAP methods (EAP-TLS, PEAP, EAP-TTLS)
• RADIUS CoA for dynamic policy changes
• Your existing access points — no hardware swap

What You Drop

• The Windows Server you were keeping alive just to run RADIUS
• Manual patching, backups, and failover for the auth tier
• A separate AD CS deployment for certificates