Review NPS authorization as an ordered network-policy decision

Source facts

NPS uses network policies together with account dial-in properties to decide whether a connection request is authorized. It compares a request against the ordered policy list and uses a matching policy with the user account properties for authorization. When that evaluation authorizes the connection, NPS applies the matching network policy settings. Microsoft Learn.

Applicability

Start with an identified request and its account, not a policy name that merely appears relevant. Distinguish authorization by a network policy from forwarding or local processing selected by a connection request policy. Preserve the ordering as part of the evidence.

DSE recommendation

Have the access owner state the intended result for a representative permitted account and a prohibited account. Compare their request characteristics with the ordered network policies and inspect the relevant dial-in settings. Before changing a condition or moving a policy, list other request populations that may match it. Keep the original policy order and account settings available for a controlled reversal.

Verification

Run the approved permitted and prohibited connection tests. Record the policy that handled each request, the account setting used in the decision, and the resulting access. If the result differs from the design, investigate earlier matching policies before broadening the intended policy conditions.

Official references

Microsoft Learn: Configure Network Policies. Source reviewed September 8, 2026.