Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Learn how Keytos EZRADIUS makes cloud RADIUS easy.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
At Keytos we understand that security is a top priority for your organization. Founded by former Microsoft security engineers, we have built a powerful and easy to use RADIUS solution designed specifically for Microsoft, leveraging the Entra ID credentials you already secure. There is no need to add another identity provider.
Most RADIUS solutions claim to be usable right out of the box. EZRADIUS is the fastest, most secure and most affordable way to get started with modern Wi-Fi authentication. JumpCloud and EZRADIUS both use EAP-TLS certificates, the most modern means of secure Wi-Fi authentication, but EZRADIUS distinguishes itself on ease of use and its integration with Microsoft identity.
EZRADIUS makes it easy to run and scale your own highly available RADIUS server without the traditional up-front expenditure associated with RADIUS authentication. We have removed the need to manage complex infrastructure, and your cloud based RADIUS service is maintained to the highest standards. That lets you focus on what matters while modernizing your network authentication.
Cloud RADIUS built for the identity provider you already have.
| Capability | |
JumpCloud |
|---|---|---|
| Pricing | $1 per active identity per month, or less | From $13 per user, per month |
| Cloud RADIUS | RADIUS and RadSec endpoints, multi-region with zonal and geo redundancy | Yes |
| Certificate authentication (EAP-TLS) | Yes | Yes |
| Password based authentication | Yes, including PAP, PEAP, MS-CHAPv2 and MAC bypass | Yes |
| SOC 2 compliant | Yes | Yes |
| ISO 27001 compliant | Yes | Yes |
| Entra ID password validation | Yes, through EAP-TTLS against Entra ID | Not covered |
| Entra ID group membership authorization | Real-time group checks, down to VLAN assignment per group | Not covered |
| Intune device health validation | Read natively, a non-compliant device fails authentication with no middleware | Not covered |
| MDM connection for certificate issuance | Through EZCA, a Microsoft-listed third-party Intune SCEP CA | Not covered |
| Bring your own infrastructure | Bring your own CA or PKI, and run a local RADIUS proxy if you need one | Not covered |
| Public CA certificate management | Through EZCA and EZMonitor, with public certificates issued by GlobalSign | Not covered |
| FIDO2 and smart card management | Through EZCMS, which registers FIDO2 keys to Entra ID's native solution | Not covered |
| Built for Microsoft customers | Built for the Microsoft cloud from the ground up | Not covered |
Comparison based on publicly available JumpCloud documentation and pricing as of September 2026.
Our cloud based RADIUS is not an off-the-shelf RADIUS service managed by a third party. It was designed from the ground up for the cloud and the threats the modern workplace brings, from Entra ID user and group membership based VLAN assignment to Intune compliance checks at authentication time.
Keytos was built by a team of former Microsoft cloud security engineers and has maintained a close relationship ever since. From graduating from the Microsoft for Startups program to becoming a trusted Intune certificate authority partner, that partnership has helped Microsoft customers around the world move to a passwordless, cloud based infrastructure.
Modernizing your network authentication can be daunting. Between standing up your certificate authority and configuring certificate based RADIUS authentication there are a lot of steps, so the experts at Keytos offer a free consultation to evaluate your organization's use case and point you at the right path. If you would rather self-serve, our step by step cloud RADIUS documentation and our YouTube channel walk through how everything works. And if you would like hands-on help during implementation, our professional services team can take on as much of it as you want.
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Setup took only one hour, with intuitive video guides. The cost of the system is also appealing. Reduced network team overhead through simplified authentication for a large user base.
Super easy to connect to our Meraki infrastructure. Eliminated WiFi passwords and the security risk of credentials written down around the office.
Very easy to set up. Took all the complexities coming from ISE.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
RADIUS solutions differ most in how they are priced. JumpCloud sells cloud RADIUS as part of its directory packages, so you buy the directory to get the RADIUS. On its published pricing the cheapest package that includes RADIUS is Core Directory, at $13 USD per user per month billed annually.
EZRADIUS is pay as you go. There is no subscription fee and you are charged for the identities that actually connect, starting at $1 each for the first 500.
We think you should be able to know the number before you talk to anyone.
If you need cloud PKI as well as cloud RADIUS, Keytos Shield bundles both for one low per-user price. EZCA and EZRADIUS can also be deployed independently if you only need one of them.
JumpCloud's cloud RADIUS comes attached to JumpCloud's directory, so adopting it means running an identity provider next to the Entra ID you already have: another set of accounts to provision and deprovision, another place a leaver has to be removed from, and another licence per person. EZRADIUS reads Entra ID directly, so your network authentication is governed by the same identities, groups and conditional access policies as everything else.
EZRADIUS asks Microsoft Graph whether a device is compliant at the moment it tries to join the network, rather than trusting a record that was accurate the last time something synced. A device that drifts out of compliance stops getting on the network, without anything else having to notice first.
Cloud RADIUS is one part of a passwordless rollout. EZCA issues the certificates that make EAP-TLS work and is listed in Microsoft's own Intune SCEP documentation, EZCMS sources, ships and enrolls the FIDO2 keys and smart cards, and EZMonitor watches your public certificates for expiry. They are separate products you can adopt when you need them, from the same platform and the same bill.
Keytos Shield combines cloud PKI, cloud RADIUS network authentication, and FIDO2 Passkey + Smart Card onboarding into a single platform built natively for Microsoft Entra ID and Intune.
EZCA replaces complex on-premises PKI with a cloud-native certificate authority built on Azure and backed by HSMs, giving you enterprise-grade security without the infrastructure burden.
EZRADIUS is the only Cloud RADIUS service built natively for Microsoft Entra ID and Intune, eliminating infrastructure overhead while delivering enterprise-grade security.
EZSSH removes the need to manage, rotate and remove SSH keys for all your users from all your hosts. No more keys in engineers' desktops waiting to be stolen by bad actors.
Get your workforce to phishing-resistant MFA faster with guided passwordless onboarding that works across all your existing Microsoft identity infrastructure.
EZMONITOR continuously scans your infrastructure for expiring TLS certificates and misconfigurations, alerting your team before an outage hits production.
No, and that is the main difference. EZRADIUS authenticates against the Entra ID you already run, so there is no second directory to populate, license or keep in sync. JumpCloud sells cloud RADIUS as part of its own directory, which means standing up an identity provider alongside the one you have.
RADIUS is not sold on its own. On JumpCloud's published pricing the cheapest package that includes it is Core Directory, at $13 USD per user per month billed annually, so you buy the directory to get the RADIUS. EZRADIUS starts at $1 per active identity for the first 500 with no subscription fee, and the calculator on this page works out your number.
No. EZRADIUS speaks standard RADIUS and RadSec, so any switch, wireless controller or VPN concentrator that can point at a RADIUS server can point at EZRADIUS. You change the server address and the shared secret.
It queries Microsoft Graph at the moment of authentication, so the answer reflects the device's compliance state right then. There is no directory sync to schedule and no connector to keep running, and a device that has fallen out of compliance fails to get on the network without anything else having to notice first.
You need something to issue the device and user certificates. EZRADIUS works with the CA you already have, and it pairs with EZCA if you would rather not run one: EZCA is listed in Microsoft's own Intune SCEP documentation, so certificates go out through the SCEP profiles you already use.
A free consultation with a Keytos engineer to go through your environment, step by step cloud RADIUS documentation and video walkthroughs if you would rather self-serve, and professional services if you want hands-on help through the implementation.
No second directory. No long-term contracts. No hidden fees. Just pay for the identities that connect, and cancel anytime.
