Entraid Radius
You cannot run a native entraid radius service straight from Microsoft cloud tools. Instead, teams link cloud users to an on-premises Network Policy Server for checks. Many teams set up this bridge to let staff log into old VPNs. They also use it for Wi-Fi networks and network switches. Still, this path often relies on broad network groups. Once a user passes the first check, they gain wide network reach. Overly broad roles let one bad login put many internal systems at risk. How an entraid ra
Blast Radius Reduction: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You cannot run a native entraid radius service straight from Microsoft cloud tools. Instead, teams link cloud users to an on-premises Network Policy Server for checks. Many teams set up this bridge to let staff log into old VPNs. They also use it for Wi-Fi networks and network switches. Still, this path often relies on broad network groups. Once a user passes the first check, they gain wide network reach. Overly broad roles let one bad login put many internal systems at risk.
How an entraid radius setup works in practice
Cloud directories speak modern web protocols like OIDC and SAML. Old routers, firewalls, and VPN gateways only speak the RADIUS protocol. To bridge this gap, admins set up a Windows Server with Network Policy Server. Next, they add the Microsoft plugin for multi-factor checks onto that server. They also sync cloud users to a local domain or set up cloud domain services.
When an engineer tries to log in, the network device sends a RADIUS packet. That packet goes to the local Network Policy Server first. The server checks the user password against the local domain directory. Then the plugin asks the cloud directory to send a multi-factor push prompt. Once the user approves the prompt, the server tells the device to open the port.
Where network login checks fall short
This setup solves a basic problem for IT teams. It lets admins use one central cloud directory for old network gear. It also adds multi-factor prompts to tools that only know simple passwords. Teams do not need to keep separate local user lists for VPNs. When someone leaves the team, disabling their cloud account stops their network login.
Yet this network check only guards the front door. RADIUS decides who can join the network or start a device session. It cannot see or control what that user does after they log in. Once inside the network, an engineer still connects to databases and servers with shared keys. Network logs show when a session started, not which SQL queries ran. Admins also cannot mask sensitive fields like emails, phone numbers, or card numbers in flight.
Blast Radius Reduction: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Moving from network entry to command control
Relying on RADIUS means keeping local Windows servers patched and running at all times. If the local policy server goes down, engineers cannot log into critical systems. Sync delays between cloud groups and local domains can also block valid work. More important, network entry checks treat every database query or shell command the same.
Modern security teams separate network reach from system permissions. Instead of putting users on the whole network, they check each database or server request. They tie identity straight to individual queries and commands. This shift removes the need for local RADIUS servers on developer workflows. It also gives audit teams clear logs of every action taken on data.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Does Microsoft offer a built-in cloud RADIUS server?
No, Microsoft does not offer a direct cloud RADIUS endpoint today. You must deploy a Windows Network Policy Server or use a third-party cloud service.
How do multi-factor prompts work with Network Policy Server?
Admins install a Microsoft extension on the local Network Policy Server. This extension forwards the second check to the cloud directory after checking the password.
Why replace RADIUS for developer database and server work?
RADIUS only grants broad network entry or basic device logins. It cannot log specific queries, limit individual commands, or rewrite sensitive data in results.