Microsoft's RADIUS server, included as a role in Windows Server. It authenticates 802.1X and VPN requests against Active Directory and applies network policies that decide who gets access under which conditions. NPS requires AD-joined infrastructure and does not natively authenticate cloud-only Entra ID accounts, which is a common constraint when organisations move away from on-premises domains.