A cloud alternative to Windows NPS
Network Policy Server is the RADIUS most organisations end up with, because it arrives free with a Windows Server that is already there. It works. The awkwardness is rarely NPS itself — it is everything NPS needs in order to exist.
That bill used to be already paid. If your identity has moved to Entra ID and your file server has gone to SharePoint, it is not: keeping NPS can mean keeping Active Directory for the sake of the Wi-Fi. That is the question this page is about.
What each one asks you to run
NPS, counted honestly
- A Windows Server to license, patch, monitor and reboot — and a second one if the network should survive the first going down
- A domain for it to join, which means domain controllers, which means Active Directory
- Active Directory Certificate Services, if you want EAP-TLS rather than passwords
- NDES and the Intune Certificate Connector on top of that, if you want Intune to enrol the certificates
- A backup and recovery plan for the certificate authority, whose private key you now own for the next decade
Passbeam
- An address and a shared credential, per site, pasted into the equipment you already own
- An application registration in Entra ID, with a handful of permissions that cannot change anything in the directory
- Profiles generated for Intune, filled in per client
The comparison people usually make is NPS against a hosted RADIUS, and on that alone NPS looks cheap. The comparison worth making is the whole column against the whole column — because the certificate authority, the connector and the second server for redundancy are not optional extras, they are what it takes to get to the same place.
Where NPS is still the better answer
Three cases, and they are real rather than polite.
- You need password-based Wi-Fi authentication
- Passbeam accepts certificates and nothing else. There is no PEAP, no MSCHAPv2, no “sign in with your Microsoft password to join the Wi-Fi”. That is a deliberate property rather than a missing feature — refusing everything that is not a certificate is what makes the guest-VLAN behaviour work — but if password-based joining is what you want, this is the wrong product and you should know that now.
- The network must authenticate with no internet at all
- NPS is on your LAN, so a severed line does not stop people joining. With any hosted service, including this one, losing your connection means new joins stop — devices already on stay on, and your equipment can be told what to do when it can reach no RADIUS server, but the honest statement is that this trades a local dependency for an internet one.
- Your identity is still genuinely in Active Directory
- If you run domain controllers you are not getting rid of, NPS talks to them directly and Passbeam does not talk to them at all. Passbeam reads Entra ID. A hybrid environment where Entra is authoritative works fine; one where AD is authoritative and Entra is a shadow does not.
Where it is not
- Offboarding
- NPS answers questions about accounts; it does not revoke certificates when somebody leaves, because that is AD CS's job and nothing joins the two. Passbeam watches Entra on a ten-minute cycle and revokes, so a disabled account stops getting on the network without anybody doing anything. More
- More than one organisation
- NPS is per-network by construction, so an IT provider looking after twenty customers runs twenty of everything. Passbeam gives each client its own certificate authority, its own directory connection and its own audit trail, separated by default.
- Knowing why something failed
- Event Viewer on a server somebody has to remote into, against a log per client that names the device, the office, the access point or switch, and the reason for a refusal. More
- The certificate authority
- AD CS means owning a root key for the next decade — backing it up, keeping it offline, and knowing what happens if it is lost. Passbeam runs one authority per client and that responsibility moves with it.
If you are weighing this up, the two pages worth reading next are what “cloud only” actually removes and what replaces NDES.
Set up your first network in under 30 minutes
Create your Passbeam account, add a client — a customer, your company, or your own house — and follow the guided checklist through Entra, PKI, Intune and RADSec. Three steps rather than four if it is a network of printers and cameras.