Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
Portnox and Keytos are both cloud-native, so the question is not whether to leave an appliance behind. It is what you pay, what the certificate authority costs, and how deep the Microsoft integration goes.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Cryptographic operations
per month in EZCA
20+
Deployment regions
around the globe
Both run in the cloud, both do certificate-based 802.1X, and both are SOC 2 Type II and ISO 27001 certified. The differences that decide a bill are commercial: what you are counted on, what the certificate authority costs, and how long you are committed.
Every price published, from $1.50 per user per month
Priced per user, with unlimited devices and certificates each
HSM-backed certificate authority included in the base price
One year of network and audit logs included as standard
Month to month, no minimum, cancel at any time
20+ deployment regions, including Azure GCC High at no extra cost
No base price published. The plan buttons say "Request a Demo"
Priced per device, so one person with three devices counts three times
Certificate authority services listed at $1 per device on top
Device data kept 14 to 60 days, then 99¢ per device per year for each extra 30
Subscription terms of 12, 24, or 36 months
RADIUS regions published as the US, Europe, and Asia/Pacific
Every Portnox figure on this page is taken from Portnox's own pricing page and its Microsoft Marketplace listing, checked in October 2026.
Portnox is a broad zero-trust access platform: NAC, ZTNA, TACACS+, and IoT profiling in one console. Keytos is a passwordless identity and PKI platform for Microsoft Entra ID. They overlap on cloud RADIUS and certificates, and diverge either side of that.
| Capability | |
Portnox |
|---|---|---|
| Pricing | $1.50 per user per month, or less See pricing by company size |
No base price published. Its Microsoft Marketplace listing reads "Price varies" |
| What you are counted on | Each licensed user, with unlimited devices and certificates | Each device, with agent-based and agentless devices mixable in one subscription |
| Cloud certificate authority | Included at no added cost, with HSM-backed root and issuing CAs | Certificate authority services listed at $1 per device |
| Cloud RADIUS with EAP-TLS | Yes, certificate-first | Yes, certificate-first |
| RadSec and legacy RADIUS methods | Yes, plus PEAP, EAP-TTLS, MS-CHAPv2, PAP, and MAC authentication bypass | Yes, plus MAC authentication bypass |
| Dynamic VLAN and ACL assignment | Yes, from Entra ID group membership | Yes |
| Local RADIUS failover when the internet is down | Yes, a container that caches credentials and policy on your network | Yes, a local RADIUS proxy |
| Deployment regions | 20+ regions worldwide | RADIUS regions published as the United States, Europe, and Asia/Pacific |
| Network and audit log retention | 1 year included, exportable to Microsoft Sentinel or any SIEM | 14 days on RADIUS, 45 on NAC, 30 on ZTNA, 60 on Universal Zero Trust. More at 99¢ per device per year for each 30 days |
| Identity sources | Microsoft Entra ID only | Entra ID, Active Directory, Google Workspace, Okta, and JumpCloud |
| Intune and Jamf device signals | Yes, live Intune compliance and Entra ID group checks on every authentication | Yes, Intune and Jamf integrations for advanced device properties, plus CrowdStrike and SentinelOne |
| Microsoft-listed Intune SCEP partner CA | Yes, EZCA is named in Microsoft's own list | Not named on that list. Issues certificates through SCEP in its own onboarding flow |
| PKI beyond network access | Yes, Azure Key Vault, Azure IoT, and public certificate monitoring | Certificates are issued for network and application access |
| SSH certificates for GitHub and Linux | Yes, with EZSSH | No |
| Passwordless onboarding for FIDO2 passkeys and smart cards | Yes, included in the base plan | Passwordless certificate authentication. Passkey and smart card issuance not documented |
| BYOD mobile and desktop app | Yes, Keytos Connect, included at no extra cost | Yes, AgentP, with agentless onboarding as well |
| TACACS+ device administration | No | Yes, with an allowance in each plan and add-on packs beyond it |
| ZTNA for remote application access | No | Yes, as its own product |
| Agent-based posture and automated remediation | No agent of its own. Compliance comes from Intune | Yes, with AgentP and continuous risk assessment |
| IoT profiling and spoof protection | No. MAC authentication bypass for non-certificate endpoints | Yes, across a catalogue it describes as 260,000+ device types |
| Guest onboarding portals | No | Yes, self, sponsor, and SMS onboarding, up to 50 guests per day |
| Azure GCC High support | Yes, at no additional cost | No public documentation |
| Self-service, fully featured, 1-month free trial | Yes, with no credit card or sales call required | Yes, 30 days |
| Minimum term | None. Month to month, cancel at any time | Subscription terms of 12, 24, or 36 months |
| SOC 2 Type II and ISO 27001 | Yes, with FIPS 140-3 validated HSMs | Yes, SOC 2 Type 2 and ISO 27001 |
| Microsoft Intelligent Security Association member | Yes | Yes |
| G2 review score | 4.8/5 across 43 reviews | 4.4/5 across roughly 120 reviews |
Portnox is a capable product and it covers ground Keytos does not. We would rather say so here than have you find out during a trial.
An identity provider other than Entra ID. Portnox authenticates against Entra ID, Active Directory, Google Workspace, Okta, and JumpCloud. Keytos builds network policy from Entra ID groups and Intune compliance only. If your users do not live in Entra ID, this decision is already made.
TACACS+ device administration. If you need role-based control of who can log in to your routers, switches, and firewalls and which commands they can run, Portnox includes a TACACS+ allowance in its plans. Keytos does not offer TACACS+ at all.
ZTNA for remote application access. Portnox sells ZTNA for secure access to SaaS and private applications. Keytos covers network authentication and certificates, not application-layer remote access.
IoT profiling and spoof protection. Portnox fingerprints unknown devices across a catalogue it describes as more than 260,000 device types. Keytos authenticates endpoints you have already decided to trust, so profiling an unmanaged estate is not something it does.
Agent-based posture with automated remediation. Portnox's AgentP continuously assesses endpoint risk and can remediate. Keytos reads Intune compliance instead, which covers most Microsoft-managed fleets but is not an on-device agent.
Guest onboarding portals. Portnox offers self-service, sponsor-based, and SMS guest onboarding. Keytos has no guest portal.
Both are cloud-native with no appliances to rack. Both do certificate-based EAP-TLS, RadSec, dynamic VLAN assignment, MAC authentication bypass, and local RADIUS failover. Both are SOC 2 Type II and ISO 27001 certified, both are members of the Microsoft Intelligent Security Association, and both offer a 30-day trial.
So the choice usually comes down to two things: whether your identity lives in Entra ID, and whether you would rather be counted per user with the certificate authority included or per device with it priced separately.
Keytos was built by ex-Microsoft cloud security engineers for organizations that run on Microsoft Entra ID and Intune. It is a passwordless identity platform rather than a network access control suite, so network authentication arrives with the certificate authority, the onboarding apps, and the SSH and server certificates around it.
Portnox prices its RADIUS, NAC, and ZTNA products per device. Keytos licenses the person. One Keytos user covers their laptop, their phone, their tablet, and every certificate issued to any of them.
In a typical knowledge-worker organization that ratio is somewhere between two and three devices per person, so the device count you are quoted on is rarely the headcount you budgeted for. It is worth running your own numbers both ways before comparing headline rates, because the unit matters more than the rate.
Yes. Keytos Shield is one subscription covering an HSM-backed cloud PKI, cloud RADIUS with classic RADIUS and RadSec endpoints, passkey and smart card onboarding, and the Keytos Connect app for personal and BYOD devices, starting at $1.50 per user per month.
Portnox lists certificate authority services as a priced line at $1 per device on its own pricing page. For EAP-TLS that is not an optional extra, it is the thing issuing the certificates, so it belongs in any honest comparison of the two bills.
Keytos keeps network and audit logs for 1 year at no extra cost, and every Keytos product can stream its logs to Microsoft Sentinel, Splunk, or any other SIEM.
Portnox publishes archived device data retention of 14 days on RADIUS, 45 days on NAC, 30 days on ZTNA, and 60 days on Universal Zero Trust, with more sold at 99 cents per device per year for each additional 30 days. If you have a compliance obligation to keep a year of authentication records, that gap is worth pricing out, because it scales with your device count rather than being a flat line.
On every authentication, not just at enrollment, Keytos reads the user's current Entra ID group membership through Microsoft Graph and the device's current Intune compliance state. A laptop that falls out of compliance, or a user removed from a group, loses network access at its next connection even though the certificate on the device is still valid.
Portnox integrates with Intune and Jamf for advanced device properties as well, alongside CrowdStrike and SentinelOne. The difference is focus rather than presence: Entra ID is one of five identity sources Portnox supports, and it is the only one Keytos is built on. Keytos EZCA is also named in Microsoft's own list of Intune SCEP partner certificate authorities, so certificates reach managed devices through the SCEP profiles you already use.
Both services answer this. Keytos includes a local RADIUS proxy, a lightweight Docker container that runs on your own network and caches user credentials and policies, so authentication continues when your internet connection is down or the cloud is unreachable. Portnox publishes a local failover RADIUS proxy of its own.
This is where the two products stop overlapping. The same certificate authority that issues your 802.1X certificates also issues TLS certificates that renew themselves in Azure Key Vault, device identity for Azure IoT fleets, and short-lived SSH certificates for Linux and GitHub. Passwordless onboarding for FIDO2 passkeys and smart cards is included in the base plan, and EZMonitor watches your public certificates.
If certificates are only ever going to be a network problem for you, that breadth is not worth paying for. If your PKI story extends past the SSID, it comes from one vendor, one security review, and one stream of logs into your SIEM.
Yes. Every Keytos price is on keytos.io, the tiers get cheaper as you grow, and the calculator below gives you your monthly cost in seconds. Keytos Shield is month to month, with no minimum, and you can cancel at any time.
Portnox's pricing page lists its plans and the features in each, which is more detail than most vendors publish, but the base price is not among them and the call to action is a demo request.
As of October 2026, Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products, including 21 for EZRADIUS and 20 for EZCA. Portnox averages 4.4 out of 5 across roughly 120 reviews.
Portnox has the larger body of feedback and Keytos has the higher score. Both are worth reading rather than taking either number on its own.
Both services are standard RADIUS, so Keytos runs alongside Portnox while you validate. There is no cutover weekend and no single date everything has to work.
Create your tenant, connect Entra ID and Intune, and either issue certificates from EZCA or trust the certificate authority you already use, so devices keep connecting while they re-enroll.
Rebuild your Portnox access policies as Keytos policies from Entra ID groups and Intune compliance, then add your controllers, access points, and switches as RADIUS clients over RADIUS or RadSec.
Validate a single SSID or switch stack, then repoint the others at your own pace. Keep Portnox for anything it covers that Keytos does not, such as TACACS+ or ZTNA.
Portnox publishes a detailed feature table but not a base price, so a direct rate-to-rate comparison is not possible from public information. What can be compared is the terms that decide the bill: the unit you are counted on, what the certificate authority costs, how long logs are kept, and how long you are committed.
| Pricing term | |
Portnox |
|---|---|---|
| List price | Starts at $1.50 per user per month with no minimum number of users | Not published. Plans are presented with a "Request a Demo" button |
| Price published on the vendor's website | Yes, every plan and tier | Features by plan are published. Prices are not |
| What you pay for | Each licensed user, with unlimited certificates and devices | Each device, so a user with a laptop, a phone, and a tablet counts three times |
| Certificate authority | Included, with unlimited issuance | Listed at $1 per device |
| Log retention | 1 year included | 14 to 60 days depending on plan, then 99¢ per device per year for each extra 30 days |
| Minimum purchase | None. Start with one user | Not published |
| Contract | Month to month. Cancel at any time | Subscription terms of 12, 24, or 36 months, with discounts beyond 12 |
| Free trial | 30 days, self-service, no credit card | 30 days |
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
If your organization runs on Microsoft Entra ID and Intune and you want certificate-based network access with the PKI included, published per-user pricing, and no multi-year term, Keytos is built for you, and as a Microsoft partner in the Microsoft Intelligent Security Association it also bills through the Azure Marketplace and runs in Azure GCC High. If you need Okta or Google Workspace, TACACS+, ZTNA, IoT profiling, or guest portals, Portnox is the broader platform and the better choice.
It depends on what you need. If your organization runs on Microsoft Entra ID and Intune and you want certificate-based network access with a cloud PKI included, Keytos Shield covers that for $1.50 per user per month with every price published. If you need Okta or Google Workspace as your identity provider, TACACS+ device administration, ZTNA for remote application access, or IoT device profiling, Portnox covers ground that Keytos does not.
Portnox does not publish a base price. Its pricing page lists the plans and the features in each one, but the call to action is Request a Demo, and its Microsoft Marketplace listing shows Price varies. The published per-device figures are add-ons: certificate authority services at $1 per device, and extended device data retention at 99 cents per device per year for each additional 30 days. Keytos publishes every price. Keytos Shield starts at $1.50 per user per month for cloud PKI and cloud RADIUS together and falls to $0.15 per user above 10,000 users. See the full pricing comparison.
Per user. One Keytos licence covers a person and every device and certificate they hold, so a user with a laptop, a phone, and a tablet costs the same as a user with one device. Portnox prices its RADIUS, NAC, and ZTNA products per device, so the same person counts three times. For organizations where people carry several devices, that difference usually matters more than the headline rate.
Yes, in the base price. Keytos Shield includes an HSM-backed cloud PKI, cloud RADIUS with RadSec, passkey and smart card onboarding, and the Keytos Connect app for BYOD devices, at one per-user price. Portnox lists certificate authority services as a priced line at $1 per device on top of the plan.
Portnox's own pricing FAQ states that subscription terms are available in 12, 24, and 36 months, with additional discounts for terms longer than 12 months. Keytos Shield is billed month to month, with no minimum and no long-term contract, and you can cancel at any time.
Keytos keeps network and audit logs for 1 year, included in the base price, and can stream them to Microsoft Sentinel or any other SIEM. Portnox's published archived device data retention is 14 days on RADIUS, 45 days on NAC, 30 days on ZTNA, and 60 days on Universal Zero Trust, with extra retention sold at 99 cents per device per year for each additional 30 days.
No. Keytos is built by ex-Microsoft engineers for Microsoft Entra ID, in commercial, GCC, and GCC High tenants, and builds network policy from Entra ID groups and Intune compliance. Portnox supports Entra ID, Active Directory, Google Workspace, Okta, and JumpCloud, so if your users do not live in Entra ID, Portnox is the better fit.
No. Keytos does not offer TACACS+ device administration or ZTNA for remote application access. Portnox offers both, with a TACACS+ allowance included in its plans. Keytos covers network authentication and the certificate lifecycle around it, including SSH certificates, Azure Key Vault certificates, and IoT device identity.
No. Portnox fingerprints unknown devices across a catalogue it describes as more than 260,000 device types, with IoT device trust and spoof protection. Keytos authenticates endpoints you have already decided to trust, including printers and cameras through MAC authentication bypass, and issues certificates to IoT fleets through EZCA, but it does not profile an unmanaged estate.
Keytos is a passwordless identity platform rather than a network access control suite. The same certificate authority that issues 802.1X certificates also issues certificates for servers and Azure Key Vault, IoT device identity, and short-lived SSH certificates for Linux and GitHub through EZSSH, alongside passwordless onboarding for FIDO2 passkeys and smart cards and public certificate monitoring with EZMonitor.
Yes. Keytos EZCA is named in Microsoft's own list of third-party certification authorities that support Intune SCEP, so certificates reach managed devices through the SCEP profiles you already use. Portnox is not named on that list, though it does issue certificates to devices through SCEP during its own onboarding flow.
Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products. Portnox averages 4.4 out of 5 across roughly 120 reviews. Portnox has the larger body of reviews and Keytos has the higher score, so it is worth reading both rather than taking either number on its own.
Yes. Both are standard RADIUS services, so you can run Keytos alongside Portnox and move one SSID or switch stack at a time. Keytos can also trust certificates issued by your existing certificate authorities, so devices keep connecting while your MDM rolls out new Keytos certificates through the same Intune or Jamf profiles.
Yes. Keytos is SOC 2 Type 2 certified and ISO 27001 compliant, and its certificate authorities run on FIPS 140-3 validated HSMs. Portnox states that it is SOC 2 Type 2 and ISO 27001 certified as well, so this is not a point of difference between the two.
Start a 30-day trial with every feature turned on and run it next to Portnox on your own access points. No quote. No minimum. No multi-year term. Cancel anytime.
