NAPCO Adds Entra ID, MFA and ExacqVision/Milestone Integration to MVP Access

NAPCO expands the identity and video layer around MVP Access

NAPCO Security Technologies announced an MVP Access update on August 24, 2026 that adds Microsoft Entra ID single sign-on (SSO), automated user provisioning, multi-factor authentication (MFA), and new integrations with ExacqVision and Milestone XProtect video management software. NAPCO describes MVP Access as its cloud-based access-control platform, with browser and mobile management tools for users, credentials, schedules and doors. ([napcosecurity.com](https://napcosecurity.com/news/expands-mvp))

The company characterizes the release as five enhancements. In practical terms, the published list separates Entra ID SSO, automated provisioning, the ExacqVision integration, the Milestone XProtect integration, and MFA. Hanwha Wave and Digital Watchdog support remain part of the platform’s video integration lineup, according to NAPCO. ([napcosecurity.com](https://napcosecurity.com/news/expands-mvp))

Entra ID can shift cardholder administration toward an IT-owned workflow

The Entra ID connection is the most consequential change for commercial projects with established identity-management processes. NAPCO says users can authenticate to MVP Access with existing corporate credentials, while automated provisioning is intended to simplify onboarding and offboarding. That potentially reduces duplicate administration between HR, IT and the security team—but only if the customer agrees on which system is authoritative for a person’s identity and access status. ([napcosecurity.com](https://napcosecurity.com/news/expands-mvp))

Microsoft describes application provisioning as the automated creation, maintenance and removal of user identities in connected applications as user status or roles change. For an access-control deployment, integrators should therefore determine whether an Entra change creates, updates, disables or removes the corresponding MVP Access user, and separately define what happens to physical credentials, mobile credentials, schedules and local visitor records. ([learn.microsoft.com](https://learn.microsoft.com/en-us/entra/id-governance/what-is-provisioning?utm_source=openai))

Two VMS choices broaden the video verification workflow

The ExacqVision and Milestone XProtect additions are designed to place access events and video in a shared operational workflow. NAPCO says operators can access live and recorded video, alarms, user information and remote-door controls from one interface. This can be useful for reviewing a forced-door alarm, confirming whether a valid credential holder entered a sensitive area, or investigating a door-held-open event without making staff move between separate systems. ([napcosecurity.com](https://napcosecurity.com/news/expands-mvp))

NAPCO has also published a Milestone XProtect integration technical resource dated August 24 and lists an MVP Access Milestone plug-in in its software library. The available material indicates a configuration process that includes installing the plug-in, configuring XProtect, linking locks to cameras and testing the result. The announcement does not specify supported VMS versions, license requirements, camera limits or feature parity across the VMS partners, so those items should be confirmed during submittal and commissioning. ([tech.napcosecurity.com](https://tech.napcosecurity.com/techlibrary/docdetails/brand_id/2/doc_id/4173?utm_source=openai))

MFA is a useful control, but its deployment details matter

NAPCO says MFA for MVP Access supports Microsoft Authenticator and Google Authenticator. Adding a second verification step is relevant for cloud-administered physical-security systems, particularly where facilities staff, dealer technicians and corporate IT personnel may all have remote administrative access. CISA recommends requiring MFA for privileged or administrative access and notes that organizations should aim for phishing-resistant methods where available. ([napcosecurity.com](https://napcosecurity.com/news/expands-mvp))

The NAPCO announcement does not state the precise MFA protocol, recovery process, role coverage or whether MFA policies can be enforced differently for dealers, customer administrators and routine operators. Procurement teams should request those details, along with audit-log retention, session controls and procedures for lost or replaced authenticator devices. MFA should be enabled alongside—not instead of—least-privilege role design and a disciplined account-removal process.

What integrators should confirm before turning on the update

For existing MVP Access accounts, the first step is a controlled pilot with the customer’s IT administrator and security manager. Map Entra users and groups to MVP Access roles, test both a new-hire and termination scenario, and confirm that an identity change does not unintentionally alter doors, schedules or credentials outside the intended scope. Establish a break-glass administrative account and document who can approve configuration changes.

For the video component, confirm the exact ExacqVision or XProtect software version, plug-in version, server reachability, operator permissions and the expected association between cameras and access points. Test live viewing, recorded-event retrieval, alarm display and remote-door-control permissions under realistic network conditions. These steps will help distinguish a demonstrable operational integration from a basic installed connector.