NPS (Network Policy and Access Service) is like a middle man between the VPN client and Azure MFA. The NPS role is installed on a domain-joined server or the domain controller and is configured to authenticate and authorize RADIUS requests from the VPN client. The VPN should be configured to use RADIUS authentication and point to the NPS server. The MFA NPS extension is installed anywhere but the VPN server. When a user/VPN client attempts to authenticate, it sends a RADIUS request to the NPS server through the VPN which performs the primary authentication and then triggers the NPS Extension for secondary authentication. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-vpn