Microsoft NPS is a legacy on-premise RADIUS server tied to Windows Server and Active Directory. As organizations migrate to Microsoft Entra ID, NPS becomes the last on-prem dependency blocking full cloud adoption. IronWiFi replaces NPS with cloud-hosted RADIUS that natively supports Entra ID, Okta, and Google Workspace — no Windows Servers, no AD sync, no hardware. Most teams complete migration in under 2 hours and save 60-80% on infrastructure costs.
NPS Is Legacy. Here's Your Modern Alternative.
Microsoft NPS is tethered to Windows Server and on-premise Active Directory. It hasn't received meaningful feature updates in years. Meanwhile, the industry has moved to Microsoft Entra ID, Okta, and Google Workspace. If you're part of the Entra ID migration wave, NPS is the on-prem anchor you don't need anymore. IronWiFi is the cloud RADIUS layer that completes that migration.
How Does IronWiFi Stack Up Against NPS?
| Factor | IronWiFi | Microsoft NPS |
|---|---|---|
| Deployment | Cloud (30 min) | On-premise (1-2 weeks) |
| Infrastructure | None required | Windows Server + AD |
| Annual Cost (500 users) | Contact sales | Windows Server licensing + maintenance |
| Microsoft Entra ID | ✓ Native | Complex (AD sync required) |
| Okta | ✓ Native | ✗ |
| Google Workspace | ✓ Native | ✗ |
| Active Directory | ✓ | ✓ |
| Captive Portal | ✓ Built-in | ✗ |
| Guest WiFi | ✓ | ✗ Separate tool |
| OpenRoaming | ✓ | ✗ |
| Web Console | ✓ | ✗ MMC only |
| High Availability | Built-in (6 regions) | Manual NLB setup |
| Uptime SLA | Multi-region | None |
| Cloud PKI | ✓ Included | ✗ Requires AD CS |
| SCEP | ✓ Included | ✗ Requires NDES |
| SAML Authentication | ✓ Included | ✗ |
| BYOD Enrollment | ✓ | ✗ |
| Compliance Certifications | SOC 2, GDPR | N/A (Windows Server role) |
What's the Problem with Cloud Identity?
NPS was built for on-premise Active Directory - that's just how it was designed. In 2026, as more teams move to cloud identity, NPS becomes the weak link:
- Microsoft Entra ID-only users can't log in - NPS needs on-premise AD sync to work
- Okta and Google Workspace? Forget it - There's no native integration
- Want MFA? Good luck - You'll need the NPS Extension and a complex Azure MFA setup
- Cloud-first companies still run on-prem servers just to keep RADIUS alive
IronWiFi cuts through all of this. You authenticate directly against Microsoft Entra ID, Okta, or Google Workspace - no on-premise infrastructure needed.
How Do the Features Compare?
| Feature | IronWiFi | Microsoft NPS |
|---|---|---|
| PEAP-MSCHAPv2 | ✓ | ✓ |
| EAP-TLS (Certificates) | ✓ | ✓ |
| EAP-TTLS | ✓ | ✓ |
| MAC Authentication | ✓ | ✓ |
| VLAN Assignment | ✓ | ✓ |
| Group-Based Policies | ✓ | ✓ |
| Social Login (Guest) | ✓ | ✗ |
| SMS/Email Registration | ✓ | ✗ |
| Payment Integration | ✓ | ✗ |
| Analytics Dashboard | ✓ | ✗ Event logs only |
| API Access | ✓ REST API | PowerShell only |
| AI-Powered Intelligence | ✓ AI Center | ✗ |
When Does NPS Still Make Sense?
- You're all-in on on-premise Active Directory with no plans to go cloud
- You've got Windows Server licenses and IT staff to manage it
- NPS is already running and working fine - if it ain't broke...
- You don't need guest WiFi or captive portals
When Is It Time to Switch to IronWiFi?
- You're moving to Microsoft Entra ID, Okta, or Google Workspace (or already there)
- You need guest WiFi with captive portals that actually work
- You're tired of maintaining on-premise RADIUS servers
- You want OpenRoaming or Passpoint support
- You'd love high availability without the NLB headaches
- You'd rather use a modern web console than the MMC
How to Migrate from NPS to Cloud RADIUS
Most organizations complete the migration in under 2 hours. You can run IronWiFi in parallel with NPS during the transition — zero downtime required.
Audit Current NPS Policies and RADIUS Clients
Export your NPS configuration: network policies, connection request policies, and RADIUS client list (access points, switches). Document your EAP methods, VLAN assignments, and group-based policies. This becomes your migration checklist.
Create IronWiFi Account and Configure Networks
Sign up for a guided demo. Add your networks and configure the same EAP methods you were using with NPS. Recreate your VLAN assignments and group-based policies in the web console.
Connect Microsoft Entra ID as Identity Provider
Link your Entra ID tenant directly to IronWiFi. No AD Connect sync, no NPS Extension — direct cloud-to-cloud authentication. Okta and Google Workspace work the same way.
Update AP/Switch RADIUS Server Addresses
Point your access points and network switches to IronWiFi's RADIUS servers. Keep NPS as a fallback server during transition. IronWiFi provides primary and secondary RADIUS IPs across multiple regions for built-in high availability.
Test with Pilot Group, Then Roll Out
Start with a single SSID or VLAN. Verify authentication, VLAN assignment, and group policies work as expected. Once confirmed, roll out to all networks. Decommission NPS when ready — you won't need it anymore.
Most organizations complete the full NPS-to-IronWiFi migration in a single maintenance window. No extended cutover, no weekend projects.
NPS vs IronWiFi: Total Cost of Ownership
NPS looks"free" because it's a Windows Server role — until you add up everything it actually costs to run.
| Cost Component | Microsoft NPS | IronWiFi |
|---|---|---|
| Server Software | Windows Server license required | Included |
| Server Hardware | Physical or VM host required | None (cloud-hosted) |
| High Availability | Second server + NLB required | Built-in (6 regions) |
| Annual IT Maintenance | Patching, monitoring, backups | Zero maintenance |
| AD Connect / Sync Tools | Setup + ongoing management | Not needed |
| Annual Subscription | N/A | Contact sales |
| Year 1 Total (est.) | Significant (hardware + licensing) | Contact sales |
| Ongoing Annual Cost | Licensing + maintenance | Contact sales |
Save 60-80%
compared to maintaining NPS infrastructure — while getting better availability, cloud IdP support, and zero hardware to manage.
What's the Bottom Line?
NPS is a relic of the on-premise era. If you've moved (or are moving) to Entra ID, Okta, or Google Workspace, NPS is the last on-prem dependency dragging you back. IronWiFi gives you cloud RADIUS with native Entra ID support — no Windows Servers, no AD sync, no hardware. Migrate in under 2 hours, save 60-80% on costs, and never patch a RADIUS server again.
Migrate from NPS in Under 2 Hours
Start your guided demo, connect Entra ID, point your APs at IronWiFi, and decommission NPS. Keep your existing access points — just change the RADIUS server address.