What is the Best Cloud PKI for Intune? Microsoft Cloud PKI vs EZCA vs Keytos Shield
Igal Flegmann |
How To Choose a Cloud PKI for Microsoft Intune
Just as with anything else in cybersecurity, choosing a certificate authority for your devices is not a one size fits all. Instead, each cloud PKI offers a set of trade-offs that depend on your current setup and your future plans for your cloud security. In this blog we are going to compare the three most popular cloud Certificate Authorities for Microsoft customers: Microsoft Cloud PKI, EZCA, and Keytos Shield. By the end of this article you will be able to choose which one is the best for you.
What is Required for a Cloud PKI for Microsoft Intune
For a cloud PKI to work with Microsoft Intune, you need to ensure that it can integrate seamlessly with Intune and support the issuance of device certificates. This typically includes:
- Supports Intune SCEP, which is Intune’s protocol for issuing certificates. Normal static SCEP or ACME won’t work with Intune.
- Can revoke certificates when Intune devices are wiped or retired. This ensures that certificates are not left active on devices that are no longer managed by Intune.
- Supports Entra ID integration, ensuring that the PKI can work seamlessly with Microsoft’s identity and access management platform.
- Operates as a Software as a Service (SaaS), meaning that the PKI infrastructure is hosted and managed by the provider, reducing the need for on-premises hardware and maintenance.
Let’s take a closer look at each of the three cloud PKI options to understand their strengths and weaknesses.
What is Microsoft Cloud PKI in Intune?
We will start with Microsoft Cloud PKI, Microsoft’s response to customers wanting to fully move to Intune. Unlike what the name implies, this is not a full cloud PKI service. Instead, this is just a cloud PKI for Microsoft Intune, meaning that it can only issue certificates to Intune managed devices. If you still have on-premises infrastructure this CA will not fully replace your AD CS, since it cannot issue certificates to your domain controllers or other servers that need certificates.
Who is Microsoft Cloud PKI For?
Microsoft Intune Cloud PKI is a great PKI option for organizations that are 100% Intune, if you have on-premise servers, or devices that are managed by another MDM, Microsoft Cloud PKI will not work for you.
Is Microsoft Cloud PKI Worth It?
If you are 100% in Intune and you have E5 licenses, then the answer is 100% yes, since it is included in your Intune license. It doesn’t matter what deals other PKI providers give you, you can’t beat free.
However, if you don’t have E5, or if you are in GCC High (as of time of writing Microsoft Cloud PKI is not available in GCC High), it is not worth the $2 USD per user cost. At just $1.50 or less, Keytos Shield is a better deal for most organizations, and it also includes a cloud RADIUS server. For organizations that do not need RADIUS, EZCA’s $200 USD flat fee makes it the best deal in the industry.
What is EZCA Cloud PKI?
EZCA is commonly cited on Reddit as Microsoft’s Cloud PKI best alternative, and is built by ex-Microsoft PKI engineers. It has all the features that Microsoft Cloud PKI has, plus domain controller certificates, server certificates, and native connection to other MDMs. This makes it the best option for any organization that is trying to move their PKI to the cloud.
Who is EZCA Cloud PKI For?
EZCA is an easy to setup cloud PKI that can be used for large and small organizations that use the Microsoft ecosystem (Entra ID is required) and want to move their PKI to the cloud but have more complex setups that Microsoft Cloud PKI cannot cover. EZCA has a great predictable pricing model with a flat fee of $200 USD per CA for basic or $500 USD per CA for premium, meaning that it doesn’t matter if you have 10 users or 10,000 users, the cost remains the same.
Is EZCA Cloud PKI Worth It?
EZCA is a great option for organizations that are looking to move their PKI to the cloud and don’t need a cloud RADIUS service. At just $200 USD per CA for basic or $500 USD per CA for premium, it is a very cost-effective solution for organizations of any size. However, if you have less than 100 users, or also need RADIUS or Passwordless Onboarding, Keytos Shield is a better option since it includes all of those features for small cost per user.
What is Keytos Shield?
Keytos Shield is more than just a cloud PKI service. It’s a full passwordless SaaS platform that includes cloud PKI, cloud RADIUS, and Passwordless Onboarding. Keytos Shield is the best option for organizations that are looking to move their PKI to the cloud but also want to implement RADIUS and/or Passwordless Onboarding for their users. Like Microsoft Cloud PKI, it supports Intune SCEP, and you can push its certificates and Wi-Fi profiles from Intune, Jamf Pro, or any other MDM.
Who is Keytos Shield For?
Keytos Shield is a great option for organizations that use the Microsoft ecosystem and are trying to move their infrastructure to zero-trust in the cloud. With Keytos Shield pricing per user, that scales with your organization, it is a great option for organizations of all sizes that want to move their security to the cloud. Keytos Shield Basic plan includes a Cloud PKI, Cloud RADIUS, and Passwordless Onboarding starting at $1.50 USD per user, making it a no-brainer for security conscious organizations.
Is Keytos Shield Worth It?
Yes, Keytos Shield is a great option for organizations that want to protect their organization and meet high security standards such as NIST, CMMC, and ISO 27001. With its low cost per user, it is the most cost-effective option for organizations while being the leader in security and features.
How Can I Get Started with a Cloud PKI for Microsoft Intune?
Ready to get started with a cloud PKI for Microsoft Intune? You can begin by exploring the options available, such as Microsoft Cloud PKI, EZCA, and Keytos Shield, and choose the one that best fits your organization’s needs. For a seamless experience with cloud PKI, consider Keytos Shield for its comprehensive features and cost-effective pricing, and start a free trial in just a few minutes.
Want to talk to an expert about getting started with a cloud PKI for Microsoft Intune? Schedule a free consultation with our team to get personalized guidance and support or learn more at keytos.io.
