{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "slug": "dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization", "url": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/" }, "title": "Separate RADIUS proxy forwarding from user authorization", "summary": "Which responsibilities belong on an NPS proxy rather than the destination RADIUS server?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:14+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Administrators designing NPS as a RADIUS proxy.", "dse_recommendation": "Create a request-flow diagram with the incoming client, applicable connection request policy, chosen remote group, and final authorization owner.", "primary_source": { "name": "Plan NPS as a RADIUS proxy", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-proxy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

An NPS proxy receives RADIUS connection requests and forwards them to other RADIUS servers for processing. Microsoft says the proxy does not perform connection authorization, so it does not need network policies for that role. The documented proxy can be a domain member or a standalone server and does not require AD DS registration to read user dial-in properties. Microsoft Learn.

\n

Applicability

\n

Confirm whether the planned NPS instance is acting as a proxy, a RADIUS server, or both in the actual design. Identify the access devices, destination server groups, and the team responsible for the final access decision. Keep forwarding configuration distinct from authorization policy.

\n

DSE recommendation

\n

Create a request-flow diagram with the incoming client, applicable connection request policy, chosen remote group, and final authorization owner. Review the network path and shared-secret handling for each hop without placing secrets in the diagram. Ask the receiving administrator to confirm which server will make the access decision. Include an unmatched request and an unavailable destination in the acceptance plan.

\n

Verification

\n

Send approved test requests through the proxy and compare the selected destination with the routing design. Check the response at the access device and the authorization result at the destination server. Preserve timestamps that allow the two teams to correlate the transaction. Resolve unexpected local handling or forwarding before production use.

\n

Official references

\n

Microsoft Learn: Plan NPS as a RADIUS proxy. Source reviewed September 8, 2026.

", "content_text": "Source facts\nAn NPS proxy receives RADIUS connection requests and forwards them to other RADIUS servers for processing. Microsoft says the proxy does not perform connection authorization, so it does not need network policies for that role. The documented proxy can be a domain member or a standalone server and does not require AD DS registration to read user dial-in properties. Microsoft Learn.\nApplicability\nConfirm whether the planned NPS instance is acting as a proxy, a RADIUS server, or both in the actual design. Identify the access devices, destination server groups, and the team responsible for the final access decision. Keep forwarding configuration distinct from authorization policy.\nDSE recommendation\nCreate a request-flow diagram with the incoming client, applicable connection request policy, chosen remote group, and final authorization owner. Review the network path and shared-secret handling for each hop without placing secrets in the diagram. Ask the receiving administrator to confirm which server will make the access decision. Include an unmatched request and an unavailable destination in the acceptance plan.\nVerification\nSend approved test requests through the proxy and compare the selected destination with the routing design. Check the response at the access device and the authorization result at the destination server. Preserve timestamps that allow the two teams to correlate the transaction. Resolve unexpected local handling or forwarding before production use.\nOfficial references\nMicrosoft Learn: Plan NPS as a RADIUS proxy. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nAn NPS proxy receives RADIUS connection requests and forwards them to other RADIUS servers for processing. Microsoft says the proxy does not perform connection authorization, so it does not need network policies for that role. The documented proxy can be a domain member or a standalone server and does not require AD DS registration to read user dial-in properties. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-proxy).\n\n## Applicability\n\nConfirm whether the planned NPS instance is acting as a proxy, a RADIUS server, or both in the actual design. Identify the access devices, destination server groups, and the team responsible for the final access decision. Keep forwarding configuration distinct from authorization policy.\n\n## DSE recommendation\n\nCreate a request-flow diagram with the incoming client, applicable connection request policy, chosen remote group, and final authorization owner. Review the network path and shared-secret handling for each hop without placing secrets in the diagram. Ask the receiving administrator to confirm which server will make the access decision. Include an unmatched request and an unavailable destination in the acceptance plan.\n\n## Verification\n\nSend approved test requests through the proxy and compare the selected destination with the routing design. Check the response at the access device and the authorization result at the destination server. Preserve timestamps that allow the two teams to correlate the transaction. Resolve unexpected local handling or forwarding before production use.\n\n## Official references\n\n[Microsoft Learn: Plan NPS as a RADIUS proxy](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-proxy). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "url": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate RADIUS proxy forwarding from user authorization", "item": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "url": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/", "headline": "Separate RADIUS proxy forwarding from user authorization", "description": "Which responsibilities belong on an NPS proxy rather than the destination RADIUS server?", "abstract": "Which responsibilities belong on an NPS proxy rather than the destination RADIUS server?", "articleBody": "Source facts\nAn NPS proxy receives RADIUS connection requests and forwards them to other RADIUS servers for processing. Microsoft says the proxy does not perform connection authorization, so it does not need network policies for that role. The documented proxy can be a domain member or a standalone server and does not require AD DS registration to read user dial-in properties. Microsoft Learn.\nApplicability\nConfirm whether the planned NPS instance is acting as a proxy, a RADIUS server, or both in the actual design. Identify the access devices, destination server groups, and the team responsible for the final access decision. Keep forwarding configuration distinct from authorization policy.\nDSE recommendation\nCreate a request-flow diagram with the incoming client, applicable connection request policy, chosen remote group, and final authorization owner. Review the network path and shared-secret handling for each hop without placing secrets in the diagram. Ask the receiving administrator to confirm which server will make the access decision. Include an unmatched request and an unavailable destination in the acceptance plan.\nVerification\nSend approved test requests through the proxy and compare the selected destination with the routing design. Check the response at the access device and the authorization result at the destination server. Preserve timestamps that allow the two teams to correlate the transaction. Resolve unexpected local handling or forwarding before production use.\nOfficial references\nMicrosoft Learn: Plan NPS as a RADIUS proxy. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:14+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-177-separate-radius-proxy-forwarding-from-user-authorization/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate RADIUS proxy forwarding from user authorization" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Plan NPS as a RADIUS proxy", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-proxy" } } ] } }