Looking for a Foxpass alternative?
Meet Keytos Shield, an all-in-one passwordless solution for Entra ID

Is cloud RADIUS included with Keytos?

Yes. Keytos Shield is a subscription that covers an HSM-backed cloud PKI, cloud RADIUS with classic RADIUS and RadSec endpoints, smart card and passkey onboarding and management, and the Keytos Connect app for personal and BYOD devices, all at one per-user price that starts at $1.50 per user per month, making it the most comprehensive RADIUS bundle in the market while still being the lowest cost RADIUS provider.

You are not forced to take the whole bundle. If you already run a certificate authority, EZRADIUS is cloud RADIUS by itself from $1 per active identity. If you already have RADIUS included with your network provider and you only need a CA, EZCA will cover your whole organization starting at $200 USD per CA with no additional cost or hidden fees.

Does Keytos use certificate-first EAP-TLS authentication?

Yes. Keytos was built by ex-Microsoft cloud PKI engineers, and EAP-TLS is how Keytos recommends setting up network authentication. Even the BYOD application Keytos Connect, which uses Entra ID to authenticate the user, uses a certificate in the background to authenticate the device and user to the network. Keytos Shield handles the whole process for you, from creating the certificate authority to creating the RADIUS profiles, in less than 10 minutes. Watch this video to see how easy it is to set up.

While we recommend using EAP-TLS wherever possible, for the printers, cameras, and legacy devices every real network still has, Keytos also supports PEAP, MS-CHAPv2, PAP, and MAC authentication bypass.

How are Keytos PKI and RADIUS integrated?

In Keytos Shield the certificate authority and the RADIUS server are one product: one subscription, one onboarding flow, and one bill. You don't have to create the CA and then go to the RADIUS server and add the trust. The onboarding guide asks you some questions about your environment and configures everything automatically.

If you are moving from an existing deployment, Shield also works with the certificates you already have. It trusts certificates from Microsoft AD CS, Microsoft Cloud PKI, or any third-party CA, and it can chain its own CA up to your existing root, so adopting it does not mean re-issuing every certificate on day one.

Does Keytos automate the whole certificate lifecycle?

Yes. EZCA handles issuance, automatic renewal, and revocation, and publishes CRLs and OCSP for every certificate authority it runs. Certificates reach managed devices through Intune SCEP, Jamf, and ACME, and reach personal devices through Keytos Connect. Keytos is one of the trusted third-party CAs listed in Microsoft's own Intune SCEP documentation.

Revocation is enforced where it counts. On every certificate authentication, Keytos checks the certificate against its CA's revocation list, so a revoked certificate stops getting onto the network at its next connection. If you do not want to wait for a new CRL to be published, Keytos can also check the values of your certificate against your Entra ID and Intune tenant, giving you true Zero Trust authentication into your network.

Does Keytos enforce network policy in real time?

Yes. On every authentication, not just when a certificate is issued, Keytos checks the user's current Entra ID group membership and the device's current Intune compliance state. A laptop that falls out of compliance, or a user removed from a group, loses network access at the next connection even though the certificate on the device is still valid.

Policies are built from the Entra ID groups and Intune compliance policies you already manage. There is no directory sync and no middleware in between.

How long does Keytos keep network and audit logs?

Keytos makes your network and audit logs available for a full year, at no additional cost. Every authentication, certificate issuance, and admin change is logged and kept for 1 year with no add-on to buy, so you can answer an auditor's or an incident responder's question months after the fact. Every Keytos product can also stream its logs to Microsoft Sentinel or any other SIEM, so your SOC team keeps its own copy for as long as your policy requires.

What happens to Wi-Fi if the internet goes down?

Your users stay connected. Keytos includes a local RADIUS proxy, a lightweight Docker container you run on any Linux server or VM on your own network. It pulls your policies from Keytos, keeps them current, and caches user credentials and policies so network access continues even when your internet connection is down or the cloud service is unreachable.

Your access points talk to the proxy over your local network, and the proxy syncs with Keytos whenever the connection is available, so you get the simplicity of cloud RADIUS with the resilience of an on-premises server.

Does Keytos handle SSH access?

Yes. EZSSH gives engineers short-lived SSH certificates for Linux servers and GitHub, issued against their Entra ID identity and the MFA and Conditional Access policies you already enforce. Access expires on its own, so there are no long-lived SSH keys to distribute, rotate, or chase down when someone leaves.

What else does Keytos cover?

Network access is rarely the only place an organization needs certificates, so Keytos covers the rest as well. Passwordless onboarding for FIDO2 passkeys and smart cards is included in the basic plan, services get TLS certificates that renew themselves in Azure Key Vault, and IoT fleets get device identity.

With Keytos, all of that comes from one vendor, one security review, and one stream of logs into your SIEM.

Does Keytos support BYOD devices, or is an MDM required?

BYOD devices are fully supported by Keytos. While Keytos integrates with all the most popular Mobile Device Management (MDM) platforms for certificate and Wi-Fi profile delivery, it also supports personal and BYOD devices via Keytos Connect, a mobile and desktop application that securely connects your Windows, macOS, iOS, iPadOS, Android, and Linux devices to your workplace or school Wi-Fi. Keytos Connect uses your existing Entra ID credentials (including any MFA or Conditional Access policies) to authenticate and provision certificates for secure Wi-Fi access using EAP-TLS, at no additional cost to your Keytos subscription.

Does Keytos publish its pricing publicly?

Yes. Every Keytos price is on keytos.io, the tiers get cheaper as you grow, and the calculator below gives you your monthly cost in seconds. Keytos Shield is month to month, with no minimum, and you can cancel at any time.

How do customers rate Keytos on G2?

As of October 2026, Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products, including 21 for EZRADIUS and 20 for EZCA, each rated 4.8, making it the highest rated in its category.