NPS extension for Microsoft Entra MFA errors: NPS event IDs, log messages and fixes

The NPS extension for Microsoft Entra multifactor authentication sits between your VPN or RADIUS client and Microsoft Entra ID, so a failure can come from RADIUS, from Active Directory, from the extension or from the cloud. This quick reference lists the Network Policy Server events and reason codes, the messages the extension logs, and the certificate, connectivity and VPN symptoms Microsoft documents, each with the usual cause and the first check.

How to read these codes#

The flow explains most errors: the VPN or NAS server sends a RADIUS request to NPS, NPS checks the password against Active Directory, and only if that succeeds does the extension ask Microsoft Entra MFA for the second factor. So decide first which stage failed.

• NPS events: Event Viewer › Custom Views › Server Roles › Network Policy and Access Services. Most failures are event 6273 or 6274; the Reason Code in the event text tells you why. These events only appear when NPS auditing is on: auditpol /get /subcategory:"Network Policy Server" should report Success and Failure (enable with auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable).
• Extension logs: Event Viewer › Applications and Services Logs › Microsoft › AzureMfa, with separate AuthN and AuthZ logs (Microsoft's docs refer to the AuthZOptCh channel). The extension's entries carry an upper-case error code; admins on Microsoft Q&A report text such as ErrorCode:: ESTS_TOKEN_ERROR Msg:: Unable to get Azure AD access token. plus a link to Microsoft's troubleshooting page.
• Isolate the extension: back up HKLM\SYSTEM\CurrentControlSet\Services\Authsrv\Parameters, delete the AuthorizationDLLs and ExtensionDLLs values, restart NPS and test again. If NPS now succeeds, the problem is in the MFA layer; restore the key afterward.
• Identity: the extension looks the user up in Entra ID by the on-premises UPN, or by the attribute in LDAP_ALTERNATE_LOGINID_ATTRIBUTE under HKLM\SOFTWARE\Microsoft\AzureMfa.

NPS events and reason codes#

Extension log messages and connectivity#

The server needs TCP 443 to login.microsoftonline.com, credentials.azure.com, strongauthenticationservice.auth.microsoft.com and adnotifications.windowsazure.com. RADIUS itself uses UDP 1812/1645 (authentication) and 1813/1646 (accounting) between the VPN and NPS. The NPS server must authenticate the request itself; it can't proxy RADIUS to another server.

Certificate and setup errors#

# Create the missing service principal (documented app ID), then rerun the setup script
Connect-MgGraph -Scopes 'Application.ReadWrite.All'
New-MgServicePrincipal -AppId 981f26a1-7f43-403b-a875-f8b09b8cd720 -DisplayName "Azure Multi-Factor Auth Client"
cd "C:\Program Files\Microsoft\AzureMfa\Config"
.\AzureMfaNpsExtnConfigSetup.ps1

The script signs in to Entra ID (Microsoft documents a Global Administrator for this), asks for the tenant ID, creates the certificate, grants NETWORK SERVICE access to its key and restarts NPS. Give each NPS server its own certificate so you can renew them one at a time.

User and VPN symptoms#

For cloud sign-in MFA errors (AADSTS50076, AADSTS50079 and friends) see fixing MFA and authentication-strength sign-in errors.

How to verify a fix#

1. Endpoints. From the NPS server every line should show True:
   PowerShell

   'login.microsoftonline.com','credentials.azure.com','strongauthenticationservice.auth.microsoft.com','adnotifications.windowsazure.com' |
       ForEach-Object { Test-NetConnection -ComputerName $_ -Port 443 | Select-Object ComputerName, TcpTestSucceeded }

2. Certificate. Check expiry locally, then compare the thumbprint with what Entra ID holds:
   PowerShell

   Get-ChildItem Cert:\LocalMachine\My | Where-Object Subject -like '*Microsoft NPS Extension*' |
       Select-Object Subject, NotAfter, Thumbprint
   Connect-MgGraph -Scopes 'Application.Read.All'
   (Get-MgServicePrincipal -Filter "appid eq '981f26a1-7f43-403b-a875-f8b09b8cd720'" -Property "KeyCredentials").KeyCredentials |
       Format-List KeyId, DisplayName, StartDateTime, EndDateTime

3. Test sign-in with an account registered for MFA. Good: an Event 6272 for that user, no new errors in the AzureMfa logs, and no 6273 reason code 21.
4. Health check. Microsoft also publishes an NPS extension health check script that runs basic checks; use it before opening a support case.

References#

• Integrate your existing NPS infrastructure with Microsoft Entra multifactor authentication (Microsoft Learn): requirements, certificates and the troubleshooting FAQ.
• Advanced configuration options for the NPS extension (Microsoft Learn): alternate login ID and IP exceptions.
• Network Policy Server troubleshooting guidance (Microsoft Learn): auditing, events 13, 18 and 6273.