Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Learn how Keytos EZCA gives you a full cloud PKI without any infrastructure to host.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
Looking for a better PKI solution? You have come to the right place. Keytos has been leading the identity and PKI space for Microsoft customers for the past few years by building cloud native PKI that helps organizations scale and protect their cloud.
SCEPman and EZCA can both be stood up quickly, and both issue Intune certificates in minutes. The difference is what happens after that. EZCA does not stop at Intune: our native Azure integrations make it a full PKI that can replace your on-premises AD CS certificate authority, and we host the whole thing for you rather than handing you an Azure app to run.
EZCA gives you a full cloud PKI you do not have to host, priced per CA instead of per user.
| Capability | |
SCEPman |
|---|---|---|
| Pricing | $200 per CA per month, unlimited users and certificates | Per user, from a 50 user minimum |
| Hosting model | Fully managed SaaS, with every resource created and paid for in the Keytos tenant | An Azure app in your own tenant, which you deploy, pay for and operate |
| Intune SCEP connection | Yes | Yes |
| Domain controller certificates for Hybrid Hello for Business | Yes | Yes |
| OCSP and CRL revocation | Yes | Yes (CRL disabled by default) |
| HSM backed CA keys | FIPS 140-3 Level 2 as standard, Level 3 on Premium, and bring your own HSM | Yes, in an Azure Key Vault you provide |
| SOC 2 and ISO 27001 compliant | SOC 2 and ISO 27001, covering the service you actually run on | ISO 27001 certified development and operations |
| ACME support | Yes, device ACME for apple devices, as well as http and dns validation for your web servers | Only device ACME for apple devices |
| Central Management Portal for MSPs | Yes, manage all your customers in one single page with your own identity | No |
| Azure Key Vault certificate rotation | Issues and automatically renews the certificates stored in your key vaults | Key Vault holds the CA key, the certificates inside it are yours to manage |
| Entra ID application certificate rotation | Yes, app registration credentials rotated before they expire | Not covered |
| Public CA certificate management | Yes, public certificates issued and renewed beside your private ones | Not covered |
| Cloud RADIUS | EZRADIUS, built by Keytos, with real-time Entra ID and Intune checks | Sold as a bundle with RADIUSaaS, a separate product |
| FIDO2 and smart card management | Shield onboards and manages FIDO2 keys and smart cards end to end | No |
| SSH access management | EZSSH issues short-lived SSH certificates and controls who can use them | Not covered |
| GCC High cloud support | Azure Public, Azure Government and Azure GCC High, with the full Keytos toolset | Yes, self-hosted |
Comparison based on publicly available SCEPman documentation as of September 2026.
While ease of use and quick setup are important factors for a PKI solution, ensuring security and compliance is paramount. EZCA is a globally trusted PKI solution that prioritizes security by adopting industry-leading measures to secure our infrastructure. Our team of experts constantly monitors and updates our systems to ensure that they meet the highest security standards. Additionally, our PKI as a service offering's high availability SLA allows your team to focus on other pressing security issues while your CAs are automatically updated and secured.
Creating a new certificate authority can be an intimidating process. Our team of PKI experts will be with you every step of the way. When you book your first EZCA demo, a PKI expert will join the call and guide you through the whole process. That same expert will then be available to answer any questions you have as you continue your PKI planning, ensuring you follow best practices.
EZCA offers a range of plans designed to meet your security needs. Our Basic CA plan enables secure certificate issuance for most organizations, while our advanced plans offer additional features that can help you meet more stringent security requirements. These features include FIPS 140-3 Level 3 HSMs, private infrastructure options, bring your own infrastructure, and bring your own HSM options. Whether you are a small business or a large enterprise, EZCA has a plan that can meet your unique security needs.
Keytos offers a complete suite of tools to help you achieve full passwordless security with Entra ID. With Keytos, you have a single, trusted provider for all your needs, including cloud certificates, RADIUS authentication, FIDO2 and smart card management, and SSH access management, all in one place.
One of the key benefits of moving to the cloud is freedom from managing your own infrastructure. The entire Keytos toolset is hosted on your behalf, meaning that Keytos ensures the availability and scalability of your deployment. Say goodbye to late-night troubleshooting calls and server restarts, Keytos has you covered.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
Ease of use and tight integration with Entra, supporting auto-renewal and hybrid CA integration.
Straightforward and well documented setup, highly reliable, vendor-agnostic approach, and a sensible pricing model based on Certificate Authorities rather than certificates issued.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
Very easy to deploy, support chat includes AI assistance with a human fallback, and integration was seamless with a quick setup.
SCEPman bills per user, in packages that start at 50 users, and the Azure resources it runs on land on your own subscription on top of that. Your PKI bill grows every time you hire.
EZCA bills per certificate authority. A Basic CA is $200 a month whether it serves 50 people or 50,000, and that price includes the infrastructure, the redundancy, the HSM and the support. There is no separate Azure bill, because nothing runs in your tenant.
Either number can look steep next to a server you already own. Both are usually well below what it costs to keep AD CS, NDES and a CRL endpoint running properly in Azure VMs. Basic and Premium cover most organizations. If you need fully isolated infrastructure, Private Infrastructure is listed with them, and if you want to run EZCA in your own environment there is a Self-Hosted Licensing plan too.
Basic
FIPS 140-3 HSM backed CAs with Azure IoT and Key Vault integration
Premium
Most popular ✦Higher throughput, public certificate management, and priority support
Private Infrastructure
Fully isolated infrastructure for your most critical workloads
If you need cloud RADIUS as well as cloud PKI, Keytos Shield bundles both for one low per-user price. EZCA and EZRADIUS can also be deployed independently if you only need one of them.
The EZCA SaaS offering makes it easy to create an Intune CA in minutes. Watch the video to see it in action, then deploy yours by following our documentation.
EZCA and EZRADIUS together make it easy to move your whole network authentication stack to the cloud. With a cloud PKI and a cloud RADIUS service from the same vendor, you can retire the on-premises infrastructure entirely and secure your network with Azure based services.
EZCA completely replaces your on-premises AD CS CA by letting you achieve everything your legacy CA did, without the maintenance and upkeep it takes to run a highly available PKI. Beyond Intune SCEP certificates, EZCA issues the certificate types below.
One of the key components of passwordless authentication, and of any modern IT stack, is Windows Hello for Business. It gives users a convenient passwordless way to authenticate to corporate resources. EZCA creates the domain controller certificates required for a Hybrid Key Trust Hello for Business deployment.
When EZCA was created, the main goal was to help organizations automate the issuance of SSL certificates for every scenario. We do that through Azure integrations, and by enabling modern certificate issuance methods such as local ACME, so your engineers can use the tools they already know for certificate lifecycle automation.
If you are issuing SCEP certificates to Intune devices, you are probably also looking at other passwordless authentication methods such as smart cards, Azure CBA and FIDO2 keys. EZCA connects to EZCMS, the first fully passwordless authentication onboarding tool for Entra ID.
Keytos was built by a team of former Microsoft cloud security engineers and has maintained a close relationship ever since. From graduating from the Microsoft for Startups program to becoming a trusted Intune certificate authority partner, that partnership has helped Microsoft customers around the world move to a passwordless, cloud based infrastructure.
Keytos Shield combines cloud PKI, cloud RADIUS network authentication, and FIDO2 Passkey + Smart Card onboarding into a single platform built natively for Microsoft Entra ID and Intune.
EZCA replaces complex on-premises PKI with a cloud-native certificate authority built on Azure and backed by HSMs, giving you enterprise-grade security without the infrastructure burden.
EZRADIUS is the only Cloud RADIUS service built natively for Microsoft Entra ID and Intune, eliminating infrastructure overhead while delivering enterprise-grade security.
EZSSH removes the need to manage, rotate and remove SSH keys for all your users from all your hosts. No more keys in engineers' desktops waiting to be stolen by bad actors.
Get your workforce to phishing-resistant MFA faster with guided passwordless onboarding that works across all your existing Microsoft identity infrastructure.
EZMONITOR continuously scans your infrastructure for expiring TLS certificates and misconfigurations, alerting your team before an outage hits production.
Yes. Both issue Intune SCEP certificates in minutes, and EZCA covers the same ground with SCEP, EST, OCSP and CRL, domain controller certificates for Hybrid Windows Hello for Business, and hierarchical CAs. EZCA then goes further with ACME, Azure Key Vault certificate rotation, Entra ID application certificate rotation and public certificate management, so it can replace AD CS rather than sitting alongside it.
No. EZCA is a full SaaS offering: every resource is created in the Keytos tenant and paid for by Keytos, and the price you see on the pricing page is the whole cost.
Yes. EZCA is listed in Microsoft's own Intune SCEP documentation as a third-party certificate authority partner, so your certificates go out through the SCEP profiles you already use in Intune.
SCEPman bills per user, in packages that start at 50 users, on top of the Azure resources you run it on. EZCA bills per certificate authority: $200 a month for a Basic CA, whether that CA serves 50 people or 50,000, with no extra costs for infrastructure. The more devices and certificates you have, the more cost effective EZCA becomes.
EZCA is Keytos' CA as a service that is charged per CA for unlimited certificates and is recommended for organizations that do not require cloud RADIUS and Passwordless onboarding, if you need the full passwordless solution try out Keytos Shield
That is what it was built for. Beyond Intune SCEP certificates, EZCA issues domain controller certificates for Hybrid Key Trust Windows Hello for Business, internal SSL certificates for sites and service to service authentication, and smart card certificates, so the scenarios that keep an AD CS server alive are covered without the server.
Yes. EZCA runs in Azure Public, Azure Government and Azure GCC High environments, and the full Keytos toolset is available to GCC High customers.
No Azure app to deploy. No infrastructure bill of your own. No long-term contracts. Just one flat price per certificate authority, and cancel anytime.
