@KarstenI has provided an excellent reply.  Note that (1) above can not be done by Windows NPS (the Windows RADIUS server).   In short, if you want to use only a Windows solution, you are going to have to use certificate-based authentication.   This is a guide to configuring everything using AD username/password authentication.  You can then layer certificate-based authentication on top of this.  If you are not sure, this might be a good first step to do, and then once you have it going, move on to the next step of certificate-based authentication. https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise  ... View more