Can Notakey use our existing Microsoft NPS server?

Yes, without any extension. The Notakey auth-proxy sits in front of NPS, lets it check the password against Active Directory, then asks the user’s phone. NPS keeps its policies.

Does Entra MFA work for a VPN without a P1 licence?

Not through the NPS extension: Microsoft states it requires Entra ID P1, P2 or Enterprise Mobility + Security. Entra ID Free covers MFA for cloud sign-ins, not RADIUS devices.

Why does the NPS extension prompt for a code instead of number matching?

NPS does not support number matching. When number matching is enforced for all users, the extension asks for a TOTP code from Microsoft Authenticator instead; users without a TOTP method registered still get plain Approve/Deny. Notakey does not use number matching either; its approval card shows the context of the login.

Comparison · Microsoft Entra multifactor authentication

Notakey vs Microsoft Entra MFA for VPN, RADIUS and on-premise logins

For organisations on Microsoft 365 wondering whether Entra ID and Microsoft Authenticator already cover the VPN, the firewall, Linux servers and Remote Desktop, or whether a separate on-premise authentication server is worth adding.

Request a demo Try the live demo

The short version

If every identity already lives in Entra ID and what you protect is Microsoft cloud sign-ins, Entra MFA with Microsoft Authenticator is the obvious choice: it is included with the tenant, supports passkeys and number matching, and Conditional Access policies are hard to match.

The picture changes for VPNs and on-premise systems. RADIUS devices reach Entra MFA only through the NPS extension, which needs a Windows NPS server, users synced to Entra, a P1, P2 or Enterprise Mobility + Security licence, an internet path to Microsoft, and which does not support number matching. Notakey is an appliance that answers RADIUS itself, uses on-premise Active Directory directly, decides the approval on your own server with only push delivery going through Apple’s and Google’s services, and adds transaction signing.

Vendor facts checked on 13 October 2026. Prices are the vendors’ published list prices on that date and change without notice.

Aspect

Notakey

Microsoft Entra multifactor authentication

Where the decision is made: NotakeyOn your appliance, on-premise or Notakey-hosted. The push notification is delivered through Apple’s and Google’s services and the phone needs an internet path for it; the approval itself is verified by your server.; Microsoft Entra multifactor authenticationIn the Microsoft cloud. The NPS extension on your NPS server calls Entra over TCP 443, so the NPS server needs an internet path to Microsoft.
Licences (list, per user per month): NotakeyCloud: first 6 users free, then €2.50. On-premise: first 10 users free, then €0.80.; Microsoft Entra multifactor authenticationEntra ID Free (included with Microsoft 365 and Azure) supports MFA for cloud sign-ins. The NPS extension for RADIUS requires Entra ID P1 ($7) or P2 ($10), billed yearly, or Enterprise Mobility + Security; per-user or per-authentication consumption licences are not compatible with it.
VPN and firewall over RADIUS: NotakeyThe auth-proxy inside the appliance sits in front of any RADIUS server, including Microsoft NPS without an extension, or the appliance’s own RADIUS plugin.; Microsoft Entra multifactor authenticationThe NPS extension on a domain-joined Windows NPS server; users must be synced to Entra with Entra Connect; the NPS server cannot proxy to another RADIUS server. Microsoft recommends a VPN timeout of at least 60 seconds.
Against push-bombing over RADIUS: NotakeyThe approval card shows service, username and, where supplied, the requesting IP; the user denies a login they did not start.; Microsoft Entra multifactor authenticationNumber matching is not supported over NPS. With number matching enforced tenant-wide, RADIUS users are prompted for a TOTP code from Authenticator instead; without a TOTP method registered they see plain Approve/Deny.
User source: NotakeyOn-premise Active Directory or LDAP directly, a RADIUS source, or users created in the Notakey dashboard. No sync to a cloud tenant needed.; Microsoft Entra multifactor authenticationEntra ID. On-premise AD users must be synced to Entra; the extension identifies them by UPN by default.
Windows login: NotakeyWindows Credential Provider for local and Remote Desktop logins with on-premise AD, optionally passwordless-only.; Microsoft Entra multifactor authenticationWindows Hello for Business for Entra-joined or hybrid-joined devices; Remote Desktop Gateway can use the NPS extension.
Transaction signing: NotakeyYes: a readable description of the payment, order or change is signed on the phone, with PSD2 dynamic linking.; Microsoft Entra multifactor authenticationNot a feature; Authenticator approves sign-ins.
Phishing-resistant factors and policy: NotakeyNo passkeys or FIDO2 keys; no Conditional Access equivalent and no device-compliance checks.; Microsoft Entra multifactor authenticationPasskeys in Microsoft Authenticator, FIDO2 security keys and certificate-based authentication; Conditional Access with P1 and risk-based policies with P2.
Linux SSH, MikroTik, legacy web apps: NotakeyDocumented integrations: pam_radius for SSH and sudo, RouterOS scripts and RADIUS for MikroTik, a SAML reverse proxy for legacy web apps.; Microsoft Entra multifactor authenticationAnything that speaks RADIUS can go through the NPS extension, with the limits above.

Choose Entra MFA if

Your users and devices are already in Entra ID and what you protect is Microsoft 365, Azure and SaaS applications federated to Entra.
You need Conditional Access, device compliance or risk-based sign-in policies.
Passkeys or FIDO2 keys are a requirement for administrators.
You already hold P1 or P2 licences and run NPS, so the RADIUS path costs you only the extension.

Choose Notakey if

Identities stay in on-premise Active Directory, or you want the approval decided on your own server rather than in a cloud tenant.
The systems to protect are RADIUS VPNs and firewalls, MikroTik, Linux servers, Remote Desktop and legacy web applications.
You want the user to see what they are approving on every VPN login, without routing it through TOTP codes.
You need transaction signing, or an EU vendor and on-premise data for audit reasons.

What Notakey does not do

No replacement for Entra ID as an identity provider for Microsoft 365.
No Conditional Access or device-compliance policies.
No passkeys or FIDO2 keys.
No telephone-call or SMS second factor.

Frequently asked questions

Can Notakey use our existing Microsoft NPS server?: Yes, without any extension. The Notakey auth-proxy sits in front of NPS, lets it check the password against Active Directory, then asks the user’s phone. NPS keeps its policies.
Does Entra MFA work for a VPN without a P1 licence?: Not through the NPS extension: Microsoft states it requires Entra ID P1, P2 or Enterprise Mobility + Security. Entra ID Free covers MFA for cloud sign-ins, not RADIUS devices.
Why does the NPS extension prompt for a code instead of number matching?: NPS does not support number matching. When number matching is enforced for all users, the extension asks for a TOTP code from Microsoft Authenticator instead; users without a TOTP method registered still get plain Approve/Deny. Notakey does not use number matching either; its approval card shows the context of the login.

Sources

Product names are trademarks of their owners and are used only to identify the products compared.

← All comparisons

Notakey vs Microsoft Entra MFA for VPN, RADIUS and on-premise logins

See your first passwordless login this week