Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
/5
Looking for a replacement for Microsoft Identity Manager Certificate Manager? EZCMS does the job MIM CM does, requesting, renewing and revoking smart card certificates, and lets you manage every smart card and digital certificate from one place.
It does not stop there. EZCMS adds the two passwordless methods MIM CM was never built for, FIDO2 keys and the Authenticator app, and it can take the hardware logistics off your team entirely.
The same smart card lifecycle, plus the methods Entra ID has added since, on infrastructure you do not have to keep alive.
| Capability | |
MIM CM |
|---|---|---|
| Pricing | Starting at $1 per user per month, published here. | Server and client access licensing, plus the servers you run it on |
| Support status | Actively developed, with new Entra ID methods added as Microsoft ships them | Mainstream support ended January 2021, extended support ends January 2029 |
| Smart card certificate lifecycle | Yes, request, renew and revoke | Yes, request, renew and revoke |
| Works with your existing AD CS | Yes, or EZCA if you want to retire AD CS too | Yes, it requires one |
| FIDO2 key management | Yes, self-service onboarding to Entra ID's own FIDO2 provisioning | Not covered |
| Authenticator app onboarding | Yes, the cheapest method to roll out, since everyone has a phone | Not covered |
| Entra ID certificate based authentication | Works with AD FS today and is Azure CBA ready for the move to cloud-only | Built for AD FS and on-premises Active Directory |
| Self-service remote onboarding | Face recognition and government ID scanning, with no one-time password and no trip to the help desk | Not covered |
| Hardware attestation and key assignment | Yes, which is what protects remote onboarding from supply chain tampering | Not covered |
| Hardware logistics and shipping | Ordering and distribution handled by the Keytos team, or run it yourself | Not covered |
| Deployment | Fully on-premises against your existing PKI, or fully managed SaaS | On-premises servers you build, patch and keep available |
| Cloud RADIUS | EZRADIUS, with real-time Entra ID and Intune checks | Not covered |
| SSH access management | EZSSH grants access per session against Entra ID, with no standing keys | Not covered |
Support dates from Microsoft's published Microsoft Identity Manager 2016 lifecycle page; the rest from Microsoft's MIM documentation, as of September 2026.
In our years of working with highly regulated industries we have learned that in PKI and identity there is no one size fits all, so our tools meet you where your infrastructure actually is. EZCMS can be hosted fully on-premises against your existing PKI, or run as a fully managed cloud SaaS where our team looks after your instance to industry standards.
You may be using AD FS for authentication today. EZCMS is also compatible with Azure certificate based authentication, so the transition to a cloud-only environment is seamless and the certificates you issue now keep giving your people access to cloud resources afterwards.
Governments around the world have turned to smart card authentication to protect themselves against identity breaches, and the evolving threat landscape is pushing every organization the same way. EZCMS lets you meet the identity requirements in US Executive Order 14028 and CMMC while improving the onboarding experience rather than degrading it.
EZCMS partners with Yubico and Microsoft to help customers go passwordless. Yubico endorses EZCMS as a trusted tool for managing YubiKey certificates, and Microsoft recognizes Keytos as a trusted partner, which is what puts EZCMS in the Azure Marketplace.
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
MIM itself comes through Microsoft licensing, which makes it feel free until you count the servers, the patching, the availability work and the fact that extended support runs out in January 2029. The bill is in the infrastructure and the people keeping it running, not the licence.
EZCMS is $1 per user per month, published, whether you host it yourself or let us run it. No server to build, and nothing to migrate off again in a few years.
Basic and Premium cover most organizations. If you have the highest security requirements, the Enterprise tier is quoted to your deployment.
Basic
Self-service and IT desk onboarding for smartcards and FIDO2 keys
Premium
Most popular ✦Adds identity-proofed onboarding, bring your own CA, and SIEM export
Enterprise
Isolated infrastructure, on-premises deployment, and custom UI
If you want to retire AD CS along with MIM CM, EZCA is the cloud certificate authority that replaces it, and Keytos Shield bundles cloud PKI and cloud RADIUS for one low per-user price.
The smart card creation experience is the part MIM CM users notice first. EZCMS uses face recognition and government ID scanning to validate a user's identity, so they can get onto the corporate network with their government ID and their biometrics instead of a one-time password or a trip to the IT help desk.
Not every user has the same needs, so several passwordless methods are available and EZCMS gets you started with any of them in Entra ID. That is how organizations have met and exceeded the identity requirements in Executive Order 14028 and CMMC: by covering everyone, not just the people a smart card suits.
FIDO2 replaces password based login credentials with a quick, secure login. As a FIDO Alliance member we built the first self-service FIDO2 onboarding system for Entra ID, so you can protect your organization with the most secure authentication method from the most secure identity provider.
The complexity of implementing smart cards has been the barrier to entry, which is why adoption stayed with federal governments and their contractors. Between Azure CBA and EZCMS, this authentication method is now available to any Entra ID customer.
The most cost effective and popular passwordless method is phone authentication, mostly because nearly everyone already has a smartphone. Letting users self-onboard to it saves real time and money.
EZCMS takes care of ordering and distributing the hardware keys, so your IT team can work on pressing security problems while our logistics team handles the shipping. If you would rather keep it in house, the integrated logistics software tracks your own inventory.
Keytos Shield combines cloud PKI, cloud RADIUS network authentication, and FIDO2 Passkey + Smart Card onboarding into a single platform built natively for Microsoft Entra ID and Intune.
EZCA replaces complex on-premises PKI with a cloud-native certificate authority built on Azure and backed by HSMs, giving you enterprise-grade security without the infrastructure burden.
EZRADIUS is the only Cloud RADIUS service built natively for Microsoft Entra ID and Intune, eliminating infrastructure overhead while delivering enterprise-grade security.
EZSSH removes the need to manage, rotate and remove SSH keys for all your users from all your hosts. No more keys in engineers' desktops waiting to be stolen by bad actors.
Get your workforce to phishing-resistant MFA faster with guided passwordless onboarding that works across all your existing Microsoft identity infrastructure.
EZMONITOR continuously scans your infrastructure for expiring TLS certificates and misconfigurations, alerting your team before an outage hits production.
Microsoft Identity Manager 2016 left mainstream support on 13 January 2021 and extended support ends on 10 January 2029, according to Microsoft's own product lifecycle page. Extended support means security fixes, not new features, so a MIM CM deployment will not gain support for FIDO2, the Authenticator app or anything else Entra ID ships between now and then.
Yes. EZCMS handles requesting, renewing and revoking smart card certificates, which is the job MIM CM does, and adds FIDO2 keys and the Authenticator app alongside them. It connects to the AD CS certificate authority MIM CM already uses, so the certificate authority does not have to move at the same time as the credential management system.
No. EZCMS works with the AD FS setup you have today and is also ready for Entra ID certificate based authentication, so the credentials you issue now keep working as you move to a cloud-only environment later. You can change one thing at a time.
Yes. In PKI and identity there is no one size fits all, so EZCMS can be hosted fully on-premises against your existing PKI, or run as a fully managed SaaS where the Keytos team looks after your instance. Both are supported, and you can start with one and move to the other.
EZCMS is how several organizations have met the identity requirements in US Executive Order 14028 and CMMC, by getting phishing resistant credentials onto every user rather than a subset. It is SOC 2 Type 2 and ISO 27001 certified and runs in Azure Government and Azure GCC High. It is not itself FedRAMP authorized, so check that against your own obligations.
Yes. EZCMS handles the logistics of ordering and distributing hardware keys, so your IT team is not tracking serial numbers in a spreadsheet or raising tickets for every new starter. You can also run distribution yourself with the integrated logistics software.
Talk to one of our identity experts about how passwordless authentication fits your zero trust road map, and how to get off MIM CM before the clock runs out.
