{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "slug": "dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together", "url": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/" }, "title": "Plan NPS domain access and authentication-method compatibility together", "summary": "Which domain permissions and access-device capabilities must be checked when NPS acts as the RADIUS server?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:13:54+00:00", "modified_at": "2026-09-08T18:26:32+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 191, "potentially_affected": "Administrators planning NPS as the authentication and authorization server.", "dse_recommendation": "Build a matrix of user domain, NPS instance, access-device type, and selected method.", "primary_source": { "name": "Plan NPS as a RADIUS server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-server", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s server-planning guidance requires choosing the domain membership of NPS. To read user dial-in properties during authorization, it directs administrators to add the NPS computer account to the RAS and NPSs group in each relevant domain. NPS supports password and certificate authentication methods, but network access servers do not all support the same methods. The method may therefore differ by access type. Microsoft documentation.

\n

Applicability

\n

Identify the user domains, NPS computer account, trust arrangement, access devices, and proposed authentication methods. Review the source’s precise domain requirements before granting directory access.

\n

DSE recommendation

\n

Build a matrix of user domain, NPS instance, access-device type, and selected method. Have directory and network-access owners review permissions and compatibility independently. Document which requests NPS will process locally and which belong to a separately designed proxy path.

\n

Verification

\n

Test an authorized representative account from each relevant domain through each intended device type. Inspect the authentication and authorization results and verify the selected method. Preserve a directory-read failure separately from an access-device compatibility failure, and resolve both before expanding the service.

\n

Official references

\n

Microsoft Learn: Plan NPS as a RADIUS server. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft’s server-planning guidance requires choosing the domain membership of NPS. To read user dial-in properties during authorization, it directs administrators to add the NPS computer account to the RAS and NPSs group in each relevant domain. NPS supports password and certificate authentication methods, but network access servers do not all support the same methods. The method may therefore differ by access type. Microsoft documentation.\nApplicability\nIdentify the user domains, NPS computer account, trust arrangement, access devices, and proposed authentication methods. Review the source’s precise domain requirements before granting directory access.\nDSE recommendation\nBuild a matrix of user domain, NPS instance, access-device type, and selected method. Have directory and network-access owners review permissions and compatibility independently. Document which requests NPS will process locally and which belong to a separately designed proxy path.\nVerification\nTest an authorized representative account from each relevant domain through each intended device type. Inspect the authentication and authorization results and verify the selected method. Preserve a directory-read failure separately from an access-device compatibility failure, and resolve both before expanding the service.\nOfficial references\nMicrosoft Learn: Plan NPS as a RADIUS server. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft’s server-planning guidance requires choosing the domain membership of NPS. To read user dial-in properties during authorization, it directs administrators to add the NPS computer account to the RAS and NPSs group in each relevant domain. NPS supports password and certificate authentication methods, but network access servers do not all support the same methods. The method may therefore differ by access type. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-server).\n\n## Applicability\n\nIdentify the user domains, NPS computer account, trust arrangement, access devices, and proposed authentication methods. Review the source’s precise domain requirements before granting directory access.\n\n## DSE recommendation\n\nBuild a matrix of user domain, NPS instance, access-device type, and selected method. Have directory and network-access owners review permissions and compatibility independently. Document which requests NPS will process locally and which belong to a separately designed proxy path.\n\n## Verification\n\nTest an authorized representative account from each relevant domain through each intended device type. Inspect the authentication and authorization results and verify the selected method. Preserve a directory-read failure separately from an access-device compatibility failure, and resolve both before expanding the service.\n\n## Official references\n\n[Microsoft Learn: Plan NPS as a RADIUS server](https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-server). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "url": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Plan NPS domain access and authentication-method compatibility together", "item": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "url": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/", "headline": "Plan NPS domain access and authentication-method compatibility together", "description": "Which domain permissions and access-device capabilities must be checked when NPS acts as the RADIUS server?", "abstract": "Which domain permissions and access-device capabilities must be checked when NPS acts as the RADIUS server?", "articleBody": "Source facts\nMicrosoft’s server-planning guidance requires choosing the domain membership of NPS. To read user dial-in properties during authorization, it directs administrators to add the NPS computer account to the RAS and NPSs group in each relevant domain. NPS supports password and certificate authentication methods, but network access servers do not all support the same methods. The method may therefore differ by access type. Microsoft documentation.\nApplicability\nIdentify the user domains, NPS computer account, trust arrangement, access devices, and proposed authentication methods. Review the source’s precise domain requirements before granting directory access.\nDSE recommendation\nBuild a matrix of user domain, NPS instance, access-device type, and selected method. Have directory and network-access owners review permissions and compatibility independently. Document which requests NPS will process locally and which belong to a separately designed proxy path.\nVerification\nTest an authorized representative account from each relevant domain through each intended device type. Inspect the authentication and authorization results and verify the selected method. Preserve a directory-read failure separately from an access-device compatibility failure, and resolve both before expanding the service.\nOfficial references\nMicrosoft Learn: Plan NPS as a RADIUS server. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:13:54+00:00", "dateModified": "2026-09-08T18:26:32+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-197-plan-nps-domain-access-and-authentication-method-compatibility-together/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan NPS domain access and authentication-method compatibility together" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 191, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Plan NPS as a RADIUS server", "url": "https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-plan-server" } } ] } }