Keytos Shield EZCA EZRADIUS EZSSH EZCMS EZMonitor

Retire your on-premises NPS servers and save up to 75% on RADIUS costs

Replace aging NPS infrastructure with a cloud-native RADIUS built natively for Microsoft Entra ID and Intune - no hardware, no patching, no HA complexity.

Integrates with

AD CS Entra ID Intune Cloud PKI Meraki Unifi Cisco Fortinet
  • Fully hosted, no hardware to deploy, patch, or monitor
  • Real-time Entra ID and Intune integration, no ghost accounts, no sync jobs
  • Keep your existing PKI, AD CS, Microsoft Cloud PKI, and EZCA all supported
  • From $1 / active identity, pay only for who connects
Start free trial Pricing Book a demo

1,200+

Global organizations
trust Keytos

45M+

RADIUS authentications
per month by EZRADIUS

12+

RADIUS regions to choose from

99.95%

Enterprise-tier service availability

4.8/5

G2 Users Love Us badge G2 High Performer, Fall 2026 badge

"No server deployment needed for wireless authentication with Entra credentials. Straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure."

Renzo Patricio C. · Senior System Administrator

The NPS problem your IT team knows too well

NPS was built for a different era. Here's why organizations are moving on.

  • Fully hosted - no servers to run, patch, or monitor

  • Real-time Entra ID auth via Microsoft Graph, no ghost accounts, no sync lag

  • Intune compliance enforced at authentication time

  • Multi-region, multi-AZ by default, up to 99.95% uptime SLA

  • Full audit log export to Sentinel, Splunk, and any SIEM

  • Pay per active identity from $1/month, no hardware investment

Windows NPS

  • You deploy, patch, and monitor NPS servers yourself

  • Relies on AD sync, delayed group data and ghost accounts

  • No visibility into whether a device is managed or compliant at login

  • Manual HA setup: redundant servers, load balancers, on-call coverage

  • Limited log retention, gaps in audit trail and investigations

  • Fixed infrastructure cost whether you have 10 or 10,000 auth requests

Securely authenticate every user and device

EZRADIUS supports the most popular authentication methods your organization relies on today.

EAP-TLS with existing PKI infrastructure

Supports AD CS, Microsoft Cloud PKI, and third-party CAs. No disruption to existing certificate lifecycle or enrollment processes and no passwords to share, leak, or manage.

EAP-TTLS with Entra ID credentials

Out-of-the-box support for Entra ID credentials without certificates. Real-time Entra ID access and group checks with no sync jobs required and ideal for BYOD or non-certificate use cases.

MAC authentication bypass

Authenticate printers, IoT devices, and other non-certificate endpoints. Centrally manage and audit MAB devices in the EZRADIUS portal and specify custom VLANs per device.

Legacy protocol support

Full support for PAP and MSCHAPv2 for backward compatibility. Ensures older devices and systems stay connected during migration so you can move at your own pace.

Migration in 3 easy steps with no downtime

Run EZRADIUS alongside your existing NPS deployment and make the switch when you're ready.

01

Connect your existing PKI and certificates

Add your AD CS, Microsoft Cloud PKI, or EZCA certificate authorities in just a few clicks. No changes to your existing certificate lifecycle.

02

Point your network to EZRADIUS

Update your network controllers to point to the closest EZRADIUS region. Classic RADIUS and RadSec both supported.

03

Authenticate to your networks

Client devices connect using their existing certificates and credentials. Windows, macOS, Android, iOS, and Linux all supported.

Start free trial Learn how it works

Broad ecosystem support

EZRADIUS integrates seamlessly with your existing network infrastructure, MDM platforms, and client devices to ensure a smooth and secure migration.

EZRADIUS network architecture diagram showing cloud RADIUS replacing Windows NPS with Entra ID, Intune, and existing PKI integration

Simple, transparent pricing

No hardware investment. No long-term contracts. No hidden fees. Just pay for what you use and cancel anytime.

Basic

Most popular ✦

A fully-featured cloud RADIUS server at an affordable price

  • Certificate authentication (EAP-TLS)
  • Entra ID authentication (EAP-TTLS)
  • Legacy authentication (PAP, PEAP, MS-CHAPv2, MAC Bypass)
  • Real-time Entra ID group checks
  • Real-time Intune compliance checks
  • RADIUS + RadSec endpoints
  • Bring your own CA/PKI
  • SIEM audit log export
  • Local RADIUS proxy
  • Entra ID commercial, GCC, & GCC high
  • Multi-region with zonal/geo redundancy
  • 99.9% availability SLA
  • Support within 1 business day

Monthly subscription cost

$0 USD
(pay only for active identities)

Monthly cost per active identity

First 500$1 USD each
Next 500$0.40 USD each
Next 9,000$0.20 USD each
Anything above$0.10 USD each
Get started

Dedicated

All the convenience of hosted RADIUS with your own dedicated infrastructure

  • Everything in Basic, plus:
  • First 200 active identities included
  • Full dynamic IP address RADIUS support
  • Dedicated infrastructure for only your users and devices
  • Choose a single region closest to you
  • 24/7 support within 24 hours

Monthly subscription cost

$400 USD
(includes 200 active identities)

Monthly cost per active identity

First 200Included in subscription
Next 300$1 USD each
Next 500$0.40 USD each
Next 9,000$0.20 USD each
Anything above$0.10 USD each
Book a demo

Enterprise

Custom, multi-region deployments with the highest SLAs and support

  • Everything in Dedicated, plus:
  • First 10,000 active identities included
  • Multi-region with zonal/geo redundancy
  • Custom hosting options
  • Up to 99.95% SLA
  • 24/7 support within 1 hour

Monthly subscription cost

$3,500 USD
(includes 10,000 active identities)

Monthly cost per active identity

First 10,000Included in subscription
Anything above$0.10 USD each
Book a demo
See full pricing details & calculator

Ready to decommission your NPS servers?

Start with a free trial, or book a free migration assessment. Our specialists will calculate your exact savings and build a risk-free migration plan tailored to your environment.

Start free trial Free migration assessment

Frequently asked questions

Yes! You can start a free trial of EZRADIUS today with no credit card required. Experience the benefits of cloud RADIUS firsthand and see how easy it is to migrate from NPS.

If you're looking to reduce the overhead of managing on-prem NPS servers, improve security with native Entra ID integration, and save costs with a pay-as-you-go model, then EZRADIUS is a great fit. We recommend starting with a free migration assessment to see the potential benefits for your specific environment.

Migration timelines vary based on the size and complexity of your environment, but many organizations complete the migration from NPS to EZRADIUS within a few days. Because there's no hardware to deploy and no complex HA setup required, the process is often much faster than traditional RADIUS migrations. We recommend starting with a free migration assessment to get a better idea of the timeline for your specific environment.

You can run EZRADIUS in parallel with your existing NPS deployment to test and validate in your environment. When you're ready, simply update your network controllers to point to EZRADIUS and decommission your NPS servers at your own pace.

Yes! You can run EZRADIUS in parallel with your existing NPS deployment to test and validate in your environment. When you're ready, simply update your network controllers to point to EZRADIUS and decommission your NPS servers at your own pace.

No changes needed. EZRADIUS supports your existing AD CS, Microsoft Cloud PKI, or third-party CAs. Just add your CA certificates to your EZRADIUS policy and optionally issue a new server certificate from your existing CA and you're good to go.

Yes! You can use your existing AD CS certificates with EZRADIUS. Just add your CA certificates to your EZRADIUS policy and optionally issue a new server certificate from AD CS and you're good to go.

No, EZRADIUS does not require any specific Entra ID licenses. You can use your existing Entra ID tenant and user accounts without needing to purchase additional licenses. We integrate with Entra ID using the Microsoft Graph API, so we can authenticate users and check group memberships in real-time without any dependency on specific license tiers.

EZRADIUS supports nearly every network controller that supports RADIUS or RadSec. Simply point it at the EZRADIUS IP addresses and you're good to go. For a full list of tested and validated network vendors, check out our supported network vendors page.

EZRADIUS has 10+ global regions to choose from, so you can select the one closest to each of your offices for optimal performance. Our Dedicated and Enterprise plans also offer custom regions, and dynamic IP support for complex global deployments.

No, EZRADIUS is designed to scale seamlessly with your organization. You can add more users or offices without needing to change your existing plan, and you only ever pay for the users and devices that authenticate each month. There are no plan limits on the number of users, devices, or offices you can have.