Keytos Shield EZCA EZRADIUS EZSSH EZCMS EZMonitor

Protect your Intune devices and networks with cloud RADIUS

Authenticate Wi-Fi, VPN, and network access with the Entra ID and Intune you already manage. No sync jobs, no bolt-ons, just native integration built for zero trust.

Integrates with

Intune Entra ID Cloud PKI Windows macOS Android iOS Azure Marketplace
  • Native Entra ID and Intune integration, enforced in real time, no sync jobs or bolt-ons
  • Intune device compliance checked at every authentication, not just enrollment
  • Instant revocation for wiped or retired devices, with no waiting on CRLs
  • Seamless Wi-Fi profiles so Windows, macOS, Android, and iOS devices connect on power-on
Deploy from Azure Marketplace Pricing Book a demo

1,200+

Global organizations
trust Keytos

45M+

RADIUS authentications
per month by EZRADIUS

12+

RADIUS regions to choose from for low latency

99.95%

Enterprise-tier service availability

4.8/5

G2 Users Love Us badge G2 High Performer, Fall 2026 badge

"No server deployment needed for wireless authentication with Entra credentials. Straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure."

Renzo Patricio C. · Senior System Administrator

Why Intune customers choose EZRADIUS

EZRADIUS was built to be the cloud RADIUS layer for Microsoft Intune, checking compliance at every connection instead of just at enrollment

  • Native Entra ID and Intune integration checked in real time, no sync jobs or bolt-ons

  • Zero trust Intune device compliance enforced at the moment of authentication, not just enrollment

  • Instant revocation the moment a device is wiped or retired with no CRL propagation delay

  • Customized network policies based on Entra ID and Intune device groups

  • Works with Microsoft Cloud PKI, AD CS, or any certificate authority

  • Seamless Wi-Fi profiles for Windows, macOS, Android, and iOS

Other cloud RADIUS providers

  • Entra ID and Intune bolted on after the fact, if supported at all

  • No checks for Intune device compliance means stale devices can still connect to the network

  • Access relies on CRL updates that can take hours or days to propagate

  • One-size-fits-all network policies, no device-group targeting

  • Locked into a single certificate authority or manual PKI setup

  • Manual Wi-Fi profile configuration, one device at a time

Zero trust for every device Intune manages

EZRADIUS treats Intune as the source of truth at the moment of connection, so compliance, revocation, and policy all follow the devices you already manage.

Compliance checked at every connection

EZRADIUS evaluates Intune device compliance at the moment of authentication, not just at enrollment, so a device that drifts out of compliance stops getting network access.

Instant revocation for wiped devices

Intune and Entra ID status is checked in real time, so wiped, retired, or rolled devices lose access immediately rather than waiting on a CRL to propagate.

Policies that follow your device groups

Build network access policies from Entra ID and Intune device or user groups, so different teams, device types, or compliance levels reach different network segments.

Wi-Fi profiles across every platform

Works with the Wi-Fi profiles you configure in Intune, so Windows, macOS, Android, and Apple mobile devices connect automatically with no end-user setup.

Built around the devices Intune already manages

EZRADIUS connects directly to Microsoft Intune and Entra ID, checking device compliance and group membership at the moment of authentication, so managed Windows, macOS, Android, and iOS devices connect automatically, with instant revocation the moment a device is wiped or retired.

EZRADIUS connected to Microsoft Intune and Entra ID, checking device compliance and group membership at authentication

Cloud RADIUS up and running in 3 easy steps

No sync jobs, no bolt-ons. Connect the Intune and Entra ID you already manage and start authenticating in minutes.

01

Deploy EZRADIUS in Azure

Deploy EZRADIUS from the Azure Marketplace in just a few clicks, with no servers or VMs to buy or maintain.

02

Push Wi-Fi profiles

Configure Wi-Fi profiles in Intune so managed devices connect automatically.

03

Start authenticating

Point your network to EZRADIUS and start authenticating your Windows, macOS, Android, and iOS devices.

Watch a tutorial video Learn how it works

EZRADIUS with Microsoft Intune

Transparent pricing

No hardware investment. No long-term contracts. No hidden fees. Just pay for what you use and cancel anytime.

Basic

Most popular ✦

A fully-featured cloud RADIUS server at an affordable price

  • Certificate authentication (EAP-TLS)
  • Entra ID authentication (EAP-TTLS)
  • Legacy authentication (PAP, PEAP, MS-CHAPv2, MAC Bypass)
  • Real-time Entra ID group checks
  • Real-time Intune compliance checks
  • RADIUS + RadSec endpoints
  • Bring your own CA/PKI
  • SIEM audit log export
  • Local RADIUS proxy
  • Entra ID commercial, GCC, & GCC high
  • Multi-region with zonal/geo redundancy
  • 99.9% availability SLA
  • Support within 1 business day

Monthly subscription cost

$0 USD
(pay only for active identities)

Monthly cost per active identity

First 500$1 USD each
Next 500$0.40 USD each
Next 9,000$0.20 USD each
Anything above$0.10 USD each
Get started

Dedicated

All the convenience of hosted RADIUS with your own dedicated infrastructure

  • Everything in Basic, plus:
  • First 200 active identities included
  • Full dynamic IP address RADIUS support
  • Dedicated infrastructure for only your users and devices
  • Choose a single region closest to you
  • 24/7 support within 24 hours

Monthly subscription cost

$400 USD
(includes 200 active identities)

Monthly cost per active identity

First 200Included in subscription
Next 300$1 USD each
Next 500$0.40 USD each
Next 9,000$0.20 USD each
Anything above$0.10 USD each
Book a demo

Enterprise

Custom, multi-region deployments with the highest SLAs and support

  • Everything in Dedicated, plus:
  • First 10,000 active identities included
  • Multi-region with zonal/geo redundancy
  • Custom hosting options
  • Up to 99.95% SLA
  • 24/7 support within 1 hour

Monthly subscription cost

$3,500 USD
(includes 10,000 active identities)

Monthly cost per active identity

First 10,000Included in subscription
Anything above$0.10 USD each
Book a demo
See full pricing details & calculator

Ready to add cloud RADIUS to your Intune environment?

Start your free 1-month trial today, connect Entra ID and Intune in minutes, and get zero trust device compliance with instant revocation.

Start free trial Book a demo

Frequently asked questions

Yes. EZRADIUS connects directly to Microsoft Intune and Entra ID, with no sync jobs, agents, or bolt-on connectors to maintain.

Yes. EZRADIUS evaluates Intune device compliance at the moment of authentication, not just at enrollment, so only managed, compliant devices are granted network access. This is core to a zero trust network architecture.

Yes. EZRADIUS checks Intune and Entra ID status in real time, so wiped, retired, or rolled devices lose network access immediately. Other cloud RADIUS providers rely on Certificate Revocation Lists (CRLs), which can take hours or even days to propagate.

Yes. EZRADIUS lets you build network access policies based on Entra ID and Intune device or user groups, so different teams, device types, or compliance levels can be routed to different network segments.

Yes. EZRADIUS trusts certificates issued by Microsoft Cloud PKI, AD CS, EZCA, or any other certificate authority, so you can keep the PKI you already have.

Yes. EZRADIUS works with the Wi-Fi profiles you configure in Intune, so managed devices connect to the network automatically as soon as they power on, with no end-user setup required.

EZRADIUS supports Windows, macOS, Android, and Apple mobile devices (iOS/iPadOS), so every platform Intune manages can authenticate to your network.

Yes. New customers get a free 1-month trial before any charges apply, so you can validate EZRADIUS against your own Intune environment before committing.