How does Keytos Shield work?

Keytos Shield is the only all-in-one PKI, RADIUS, and Passkey platform built natively for Entra ID and Intune, along with the wide ecosystem of MDM platforms.

Start free trial Book a demo

A natural fit for your environment

Keytos Shield connects natively to your Entra ID directory and provides both a cloud PKI and cloud RADIUS service for all your managed and BYOD devices.

Move to passwordless identities and network authentication in 4 easy steps

Create a Shield subscription

Simple deployment from the Azure marketplace or directly through us.

Onboard your environment

Follow our interactive step-by-step onboarding flow to configure your PKI environment and connect Shield to Entra ID.

Connect your network

Leveraging Shield's cloud RADIUS service to connect your network via RADIUS + RadSec without any servers.

Configure your devices

Connect to your MDM to distribute certificate + Wi-Fi profiles or leverage Keytos Connect for personal and BYOD devices.

Protocols & technical details

Certificate authorities & cloud PKI

Protocols Intune SCEP, Static SCEP, Device ACME

Cipher suites RSA, ECC

Key sizes 2048/4096 (RSA), P256/P384 (ECC)

CA key storage Hardware Security Module (HSM)

Network security & cloud RADIUS

Certificate sources Shield (included), EZCA, Microsoft AD CS, Microsoft Cloud PKI, any 3rd-party CA

RADIUS transport RADIUS, RadSec (RADIUS over TLS)

RADIUS protocols EAP-TLS, EAP-TTLS, PAP, MS-CHAPv2, PEAP, MAB

Deployment & compliance

Sovereignty 4 sovereign instances to choose from (USA, EU, AUS, US-GOV GCC High)

Compliance SOC 2 Type II, ISO 27001, FIPS 140-3/3 HSM-backed

Go passwordless today

No hardware investment. No long-term contracts. No hidden fees. Just pay for the users who connect, and cancel anytime.

Start free trial Book a demo

Transparent pricing

Full pricing

Basic

Cloud PKI + Cloud RADIUS + Passkey/CBA onboarding

Starting at$1.50 per user / month

Premium

Frequently asked questions

Yes! You can start a free 1-month trial of Keytos Shield today with no credit card required. Simply create your subscription, follow the onboarding flow, and get up and running in just a few minutes. If Shield meets your needs simply add a payment method to continue using it.

Keytos Shield starts at just $1.50 USD per licensed user per month, with a tiered pricing model that goes down in price as you add more users. Visit our pricing page for more information.

No. You can get started with Keytos Shield with just a single user. You only pay for the licensed users and there are no minimums or added fees.

No. EZCA and EZRADIUS will continue to run and be supported as standalone services that you can continue to deploy and operate within your environment. Keytos Shield is a new all-in-one platform that is actually built on top of EZCA and EZRADIUS, and provides a more SaaS-like experience for cloud PKI and cloud RADIUS. You can choose which approach better fits your needs.

No, Keytos Shield is a standalone SaaS subscription that includes both cloud PKI and cloud RADIUS functionality.

We don't have a single click migration experience (yet), so you'll need to reconfigure your MDM and network settings to point to your Shield subscription instead of your EZCA and EZRADIUS endpoints.

Yes! During onboarding we'll ask you for the details of your existing PKI environment and if you want to chain your Shield SCEP CA up to your on-premises or 3rd party root CA.

No. Every Keytos Shield subscription comes with Keytos Connect, our mobile and desktop app, at no extra charge. This will get your devices connected to your Shield-enabled Wi-Fi networks in just a few clicks or taps.

Yes! Keytos Shield is available for Azure GCC High customers and tenants so you can connect and protect your most mission-critical workloads.

It's easy to add your Microsoft Cloud PKI certificate authorities to Keytos Shield so you can easily connect your Intune devices to your network. Plus, with Keytos Shield you can issue certificates to additional MDM platforms as well as personal devices via Keytos Connect.