Can Passbeam replace our Windows NPS server?

Yes. It's the most common reason people come to us. NPS needs a Windows server to patch and a certificate authority to run and back up, and if that server fails the Wi-Fi goes with it. Passbeam does the same job with nothing at the client's site.

Check one thing before you plan the move: what your NPS is actually doing. If it's doing EAP-TLS with certificates, Passbeam is a like-for-like replacement. If it's doing PEAP-MSCHAPv2 with domain passwords, it isn't. Passbeam doesn't do password-based EAP, so you're also changing method, and every device needs a certificate before it can connect. See “Do you support PEAP, MSCHAPv2 or EAP-TTLS?”.

Run both side by side for a while. Add Passbeam's two addresses to the RADIUS profile next to the existing server, enrol a few devices and watch them in the authentication log. Then move the rest and take NPS out of the profile last. You don't have to remove the old server first.

Certificates don't carry over. Passbeam has its own authority for each client, so devices get a new certificate and a new trusted root through Intune or another MDM. After that, nobody has to keep the old CA running.