Enabling Duo on RRAS w/NPS

Duo Proxy is all set up, and configuration verified with the connectivity tool. But no requests are getting that far.

Changing RRAS from Windows Auth to RADIUS, pointed it to the Duo Proxy. RRAS sits on a DC with NPS running. I’ve tried all sorts of combinations of client and server protocol settings. Following the configuration notes on the Duo site here Two-Factor Authentication for Microsoft RRAS VPN connections | Duo Security

I am going to look closely at NPS policies because I suspect this is where things are getting caught, never reaching the Duo Proxy. I’ve heard comments from others on forums about NPS causing issues in this flow. Does Duo have any recommendations on policies that should be configured, or tips on how to route around this?