RADIUS feature in Entra ID

Question

Hi All,

Referring to this document, it explains that Entra ID can be integrated with RADIUS for MFA needs.

https://learn.microsoft.com/en-us/entra/architecture/auth-radius

The question is, Does Entra ID have a RADIUS feature itself?

Thank you.

Answer 1

Hello @Irvanda,

Entra ID does not have a native RADIUS feature. Instead, it integrates with RADIUS through the Network Policy Server (NPS) extension. This extension allows Entra ID to provide multifactor authentication (MFA) for applications and network devices that rely on the RADIUS protocol.

The Network Policy Server (NPS) extension acts as an adapter between RADIUS-based applications (like VPNs, Wi-Fi controllers, etc.) and Entra ID, enabling MFA. The NPS server authenticates a user's credentials against Active Directory and then sends the MFA request to Azure.

Please find the flow below to understand how RADIUS is integrated with Microsoft Entra ID.

• Client Application (VPN client): Sends authentication requests to the RADIUS client.
• RADIUS Client: Converts requests from the client application and sends them to the RADIUS server with the NPS extension installed.
• RADIUS Server: Connects with Active Directory for primary authentication and passes the request to the NPS extension for secondary authentication.
• NPS Extension: Triggers a request to Entra ID for MFA and completes the authentication request by providing the RADIUS server with security tokens.

For more details on configuring NPS extension to require MFA for RADIUS client - Integrate your existing Network Policy Server (NPS) infrastructure with Microsoft Entra multifactor authentication