Passwordless made simple. One platform. Zero passwords.
Keytos Shield combines cloud PKI, network authentication, and passwordless onboarding into a single platform built natively for Microsoft Entra ID and Intune.
1,000+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month
7.3M+
Cryptographic operations
per month
20+
Deployment regions
around the globe
/5
"Effortless Setup, Outstanding Support. It's something you can get up and running in 30 minutes, and you don't have to worry about it after—it's just set and forget. The support has been great too with the team, and the support documents make it easy to start."
Verified User - G2 Reviews
One platform, fully assembled
Most passwordless projects stall during complex integration steps. Shield's certificate authority, RADIUS service, and identity and MDM connections are provisioned together and ready to go on day one.
A complete Cloud PKI solution
A complete PKI environment is created and HSM-secured the moment you subscribe, at no charge on top of your per-user price. Issue certificates via SCEP, ACME, and Smart Card onboarding without costly and complex solutions.
RADIUS authentication, ready to connect
A managed RADIUS service comes with every subscription. No servers to stand up, no NPS to maintain. Point your access points, switches, and VPN concentrators to the RADIUS or RadSec endpoint we give you, and Shield handles the rest.
Smart card + passkey onboarding
(coming soon) Eliminate your user passwords entirely and move to passkeys for your users and hardware security keys for your most privileged administrators. Onboard and reset your credentials via a simple, self-service workflow.
BYOD onboarding via Keytos Connect
Easily connect your unmanaged and personal laptops, phones, and tablets to your Wi-Fi network without expensive and complicated MDM configuration. Simply download the free Keytos Connect app and get connected in just a few clicks.
How Keytos Shield delivers passwordless authentication for Microsoft environments
No PKI or RADIUS expertise required
Create a subscription
One-click deployment from the Azure Marketplace or directly in our portal and leave the infrastructure management to us.
Onboard your environment
Follow our interactive step-by-step guide to connect Shield's cloud PKI and cloud RADIUS to your users, devices, and network.
Configure your devices
Managed devices receive a Wi-Fi profile and certificate via your MDM. Personal devices onboard via Keytos Connect. Never any passwords to distribute, rotate, or reset.
Built by ex-Microsoft engineers, trusted by industry leaders
Go passwordless today
No hardware investment. No long-term contracts. No hidden fees. Just pay for the users who connect, and cancel anytime.
Transparent pricing
Full pricingBasic
Cloud PKI + Cloud RADIUS + Passkey/CBA onboarding
Premium
Most popular ✦Hardened infrastructure + Premium support/SLA
Frequently asked questions
Yes! You can start a free 1-month trial of Keytos Shield today with no credit card required. Simply create your subscription, follow the onboarding flow, and get up and running in just a few minutes. If Shield meets your needs simply add a payment method to continue using it.
Keytos Shield starts at just $1.50 USD per licensed user per month, with a tiered pricing model that goes down in price as you add more users. Visit our pricing page for more information.
No. You can get started with Keytos Shield with just a single user. You only pay for the licensed users and there are no minimums or added fees.
No. EZCA and EZRADIUS will continue to run and be supported as standalone services that you can continue to deploy and operate within your environment. Keytos Shield is a new all-in-one platform that is actually built on top of EZCA and EZRADIUS, and provides a more SaaS-like experience for cloud PKI and cloud RADIUS. You can choose which approach better fits your needs.
No, Keytos Shield is a standalone SaaS subscription that includes both cloud PKI and cloud RADIUS functionality.
We don't have a single click migration experience (yet), so you'll need to reconfigure your MDM and network settings to point to your Shield subscription instead of your EZCA and EZRADIUS endpoints.
Yes! During onboarding we'll ask you for the details of your existing PKI environment and if you want to chain your Shield SCEP CA up to your on-premises or 3rd party root CA.
No. Every Keytos Shield subscription comes with Keytos Connect, our mobile and desktop app, at no extra charge. This will get your devices connected to your Shield-enabled Wi-Fi networks in just a few clicks or taps.
Yes! Keytos Shield is available for Azure GCC High customers and tenants so you can connect and protect your most mission-critical workloads.
It's easy to add your Microsoft Cloud PKI certificate authorities to Keytos Shield so you can easily connect your Intune devices to your network. Plus, with Keytos Shield you can issue certificates to additional MDM platforms as well as personal devices via Keytos Connect.