A cloud alternative to Windows NPS
Network Policy Server is the RADIUS server most organisations end up with, because it comes free with Windows Server. It works well. The cost is in what NPS needs around it.
When everything else ran on-premises, you already had all of that. If your identity has moved to Entra ID and your files to SharePoint, keeping NPS can mean keeping Active Directory just for the Wi-Fi.
What each one asks you to run
NPS
- A Windows Server to license, patch, monitor and reboot, and a second one if the network should keep working when the first goes down
- A domain for it to join, so domain controllers and Active Directory
- Active Directory Certificate Services, if you want EAP-TLS rather than passwords
- NDES and the Intune Certificate Connector on top of that, if you want Intune to enrol the certificates
- A backup and recovery plan for the certificate authority and its private key
Passbeam
- An address and a shared credential for each site, entered into the equipment you already own
- An app registration in Entra ID, with permissions that cannot change anything in the directory
- Intune profiles, generated for each client
Compared only with a hosted RADIUS service, NPS looks cheap. But the certificate authority, the connector and a second server are all needed to reach the same result, so compare the whole of each column.
Where NPS is still the better answer
- You need staff to join 802.1X Wi-Fi with a password
- Passbeam's 802.1X uses certificates. There is no PEAP or MSCHAPv2, and staff cannot join with their Microsoft password, because Entra does not expose a password a network can check. If your staff must join 802.1X Wi-Fi with a username and password, NPS is the better fit.
- The network must authenticate with no internet at all
- NPS is on your LAN, so losing your internet line does not stop people joining. With any hosted service, including Passbeam, new joins stop while the line is down. Devices already connected stay connected, and you can set what your equipment does when it cannot reach a RADIUS server, but you are swapping a local dependency for an internet one.
- Your identity is still in Active Directory
- If you are keeping your domain controllers, NPS talks to them directly. Passbeam does not; it reads Entra ID. A hybrid setup where Entra is the source of truth works well. One where Active Directory is the source of truth and Entra is a copy does not.
Where Passbeam is the better answer
- Offboarding
- NPS does not revoke certificates when someone leaves. That is AD CS's job, and nothing connects the two. Passbeam checks Entra every ten minutes and revokes the certificates of disabled accounts, so leavers lose network access without anyone having to act. More
- More than one organisation
- NPS serves one network, so an IT provider with twenty customers runs twenty of everything. In Passbeam each client has its own certificate authority, directory connection and audit trail, kept separate from the others.
- Knowing why something failed
- With NPS, you remote into the server and search Event Viewer. Passbeam keeps a log for each client showing the device, the site, the access point or switch, and why a connection was refused. More
- The certificate authority
- With AD CS you own a root key for years, and you have to back it up, keep it safe and plan for losing it. Passbeam runs a certificate authority for each client and looks after its keys.
Read next: what “cloud only” removes and what replaces NDES.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client (a customer, your company or your own home) and follow the guided checklist through Entra, PKI, Intune and RADSec. A network of only printers and cameras takes three steps.