Solutions
Cloud PKI, cloud RADIUS, passwordless onboarding, all in one platform.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
RADIUSaaS is a RADIUS service, so it still needs a certificate authority. Keytos Shield puts cloud RADIUS, an HSM-backed cloud PKI and BYOD onboarding, and passkey management in one per-user price, built for Microsoft Entra ID and Intune.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Digital identities
created per month
20+
Deployment regions
around the globe
Both run in the cloud, both validate client certificates over EAP-TLS, both support RadSec, and both are ISO 27001 certified. The difference is what you are buying: RADIUSaaS is the RADIUS service and needs a certificate authority next to it, while Keytos Shield includes the certificate authority, the RADIUS service and the onboarding app in one per-user price.
Cloud RADIUS and HSM-backed cloud PKI in one subscription
Less than RADIUSaaS plus SCEPman at list price, at every size
Entra ID groups and Intune compliance read on every authentication
Password Wi-Fi checked against Entra ID through EAP-TTLS
Up to 99.99% uptime SLA and 1 year of logs included
SOC 2 Type 2 and ISO 27001 compliant
Self-service 30-day trial, no credit card required
No certificate authority included. SCEPman is sold separately or in a bundle
50-user minimum, counted whether or not the device ever connects
Entra ID groups are not among its documented rule filters
Password accounts are created in the RADIUSaaS portal, with no identity provider integration
99.5% availability goal and 75 days of logs
No SOC 2 compliance, only ISO 27001
Trial requested through a form or by email
RADIUSaaS validates certificates but does not issue them, so to compare like with like you need RADIUSaaS plus a certificate authority. glueckkanja's own CA is SCEPman, and both products publish per-user list prices in euros, excluding sales tax, with a 50-user minimum each.
Keytos Shield includes the cloud PKI and the cloud RADIUS in one per-user price in US dollars, with no minimum. Even counting one euro as one dollar, Shield's monthly price is lower than RADIUSaaS plus SCEPman at every size below.
| Licensed users | |
RADIUSaaS + SCEPman |
|---|---|---|
| 1 user | $1.50 a month | €138 a month (€83 + €55), or €125 billed annually |
| 50 users | $75 a month | €138 a month (€83 + €55), or €125 billed annually |
| 250 users | $375 a month | €688 a month (€413 + €275), or €625 billed annually |
| 1,000 users | $1,045 a month | €1,307 a month (€784 + €523), or €1,188 billed annually |
| 5,000 users | $2,045 a month | €3,507 a month (€2,104 + €1,403), or €3,188 billed annually |
| 10,000 users | $3,045 a month | €5,432 a month (€3,204 + €2,228), or €4,938 billed annually |
| What a licence covers | One user, with unlimited devices and certificates | One user enabled on at least one device, up to five stationary and five mobile devices for RADIUSaaS |
| Minimum purchase | None. Start with one user | 50 users per organization for each product |
| Contract | Month to month. Cancel at any time | Monthly or annual plans, billed for the entire cycle in advance |
| Free trial | 30 days, self-service, no credit card | Requested through a form or by email |
RADIUSaaS is a certificate-first RADIUS service from glueckkanja, the company behind SCEPman, and it works with certificates from any CA. Keytos Shield is a passwordless identity platform for Microsoft Entra ID, so the certificate authority, the RADIUS service and the authorization decisions all come from the same identities, groups and compliance policies as the rest of your Microsoft estate.
| Capability | |
RADIUSaaS |
|---|---|---|
| Pricing | $1.50 per user per month, or less, with the PKI included See pricing by size |
From €83 a month for 50 users on monthly billing, or €75 billed annually, excluding sales tax. No CA included |
| Cloud certificate authority | Included at no added cost, with FIPS 140-3 HSM-backed root, SCEP and smart card CAs | Not included. Bring your own, such as SCEPman or Microsoft Cloud PKI |
| What you are counted on | Each licensed user, with unlimited devices and certificates | Each user enabled to authenticate on at least one device, whether or not the device is in use, up to five stationary and five mobile devices |
| Minimum purchase | None | 50 users per organization |
| BYOD onboarding | Yes, Entra ID MFA authentication with Keytos Connect mobile and desktop app, included at no extra cost | Through username and password accounts managed in the RADIUSaaS portal |
| FIDO2 passkey and smart card onboarding | Yes, included in the base plan | Not documented |
| Certificate authentication (EAP-TLS) | Yes | Yes |
| RADIUS and RadSec endpoints | Both, served directly | Core servers accept RadSec only. Classic RADIUS goes through RADIUSaaS proxies that convert it to RadSec |
| Entra ID User Authentication | Yes, Entra MFA through Keytos Connect, password based through EAP-TTLS against Entra ID | No. Password accounts are created and managed in the RADIUSaaS portal |
| Legacy methods and MAC authentication bypass | PEAP, MS-CHAPv2, PAP and MAC authentication bypass | EAP-TTLS-PAP, EAP-TTLS-MSCHAPv2 and PEAP-MSCHAPv2 for portal accounts. MAB-to-EAP only, not MAB over plain PAP or CHAP |
| Entra ID group membership authorization | Real-time group checks, down to VLAN assignment per group | Not among its documented rule filters, which match certificate fields, usernames, SSIDs, switch MACs, NAS and IP addresses |
| Intune device compliance | Yes, dynamic authentication based on Intune compliance state | No |
| RADIUS geographies | A geography of your choice on Basic, all available geographies on Premium | Additional RadSec endpoints at extra cost. |
| Local RADIUS failover when the internet is down | Yes, a container that caches credentials and policy on your network | Not documented. Its proxies are hosted by RADIUSaaS in 19 cities |
| Azure GCC High support | Yes, at no additional cost | Not documented. Core service regions are Australia, Europe, the United Kingdom and the United States |
| Network and audit log retention | 1 year included, exportable to Microsoft Sentinel or any SIEM | 75 days, with export to Azure Log Analytics, Microsoft Teams or a webhook |
| MSP central management | Yes, manage all customers in one portal with your own identity | Not supported |
| Uptime | 99.9% SLA on Basic, 99.99% on Premium | 99.5% availability goal per calendar month |
| Support | Within 1 hour for incidents. 1 business day on Basic, within 24 hours on Premium. Support within one hour can be purchased with professional services | Typically under 4 hours for incidents, Monday to Friday, 08:00 to 18:00 CET, in English and German |
| Free trial | 30 days, self-service, no credit card required | Requested through a form on its website or by email |
| ISO 27001 | Yes | Yes |
| SOC 2 Type II | Yes | Not referenced in its documentation |
Comparison based on publicly available RADIUSaaS documentation and pricing as of October 2026.
RADIUSaaS is a capable certificate-based RADIUS service. There are situations where it is the better choice, and we would rather say so here than have you find out during a trial.
You are standardized on SCEPman and want one vendor. RADIUSaaS and SCEPman come from the same company.
You deploy Wi-Fi profiles from Google Workspace. RADIUSaaS documents profile deployment from Microsoft Intune, Jamf Pro and Google Workspace, and supports Okta for signing in to its admin portal. Keytos is built for Microsoft Entra ID, so if your users do not live in Entra ID, RADIUSaaS is the better fit.
You want a European vendor with support in German. glueckkanja AG lists offices in Germany, Austria, Spain, Switzerland and Australia, offers support in English and German.
Keytos was built by ex-Microsoft cloud security engineers for organizations that run on Microsoft Entra ID and Intune. Keytos Shield treats Entra ID as the source of truth for every certificate and every network decision, and puts the pieces a certificate-based Wi-Fi rollout needs into one subscription.
Yes. Keytos Shield is one subscription covering an HSM-backed cloud PKI, cloud RADIUS with classic RADIUS and RadSec endpoints, and the Keytos Connect app for personal and BYOD devices, starting at $1.50 per user per month. A complete PKI is created the moment you subscribe, and you can chain its SCEP CA up to a root you already run.
RADIUSaaS validates certificates but does not issue them. Its documentation describes using SCEPman, Microsoft Cloud PKI or an on-premises PKI alongside it, and glueckkanja sells SCEPman separately or in a bundle with RADIUSaaS. For EAP-TLS the CA is not optional, so it belongs in any honest comparison of the two bills.
One Keytos Shield licence covers a person and every device and certificate they hold, with no minimum number of users and no long-term contract.
Under the RADIUSaaS licensing terms, a user needs a licence if they are enabled to authenticate on at least one device, whether or not that device is in use, with a minimum of 50 users per organization. Each licence covers up to five stationary and five mobile devices. RADIUSaaS also notes that it does not display your licence consumption, so you are asked to check profile assignments in your MDM yourself.
On every authentication, not just at enrollment, Keytos reads the user's current Entra ID group membership through Microsoft Graph and can assign a VLAN per group. Remove someone from a group and the change applies at their next connection, even though the certificate on their device is still valid.
The RADIUSaaS rule engine filters on client IPs, certificate attributes, usernames, Intune tenant IDs, SSIDs, switch MACs, NAS identifiers and NAS IPs, and assigns VLANs statically or from values read out of the certificate. Entra ID group membership is not among the documented filters, so policy by team or department is expressed through what the certificate carries, such as an OU in the subject, as in RADIUSaaS's own examples.
Keytos asks Microsoft Graph whether a device is compliant at the moment it tries to join the network, rather than trusting a record that was accurate the last time something synced. A device that drifts out of compliance stops getting on the network at its next connection, without anything else having to notice first.
RADIUSaaS lists a device compliance check as a capability of its RADIUSaaS and SCEPman bundles. If you are not using SCEPman as your CA, check how compliance would be enforced in your setup before you commit.
With Keytos, yes. For devices that cannot hold a certificate yet, Keytos validates the user's password against Entra ID through EAP-TTLS, so there is no second set of network accounts to create, rotate or remove when someone leaves.
RADIUSaaS takes a different position. Its user documentation states that it does not integrate with any identity provider for username and password network authentication, and that those accounts must be managed in the RADIUSaaS admin portal. It also advises against using a person's real Entra ID password for them. For organizations that need password access during a certificate rollout, that means a separate account list to maintain by hand or by spreadsheet import.
Shield includes the Keytos Connect mobile and desktop app at no extra cost, so a user can enroll a personal device and receive a certificate without an IT ticket. FIDO2 passkey and smart card onboarding is coming soon to the Shield base plan, from the same subscription.
RADIUSaaS lists BYOD and guest access among the scenarios for its portal-managed username and password accounts, alongside time-limited guest invitations.
Keytos keeps network and audit logs for 1 year at no extra cost, and every Keytos product can stream its logs to Microsoft Sentinel, Splunk or any other SIEM. Shield Basic carries a 99.9% uptime SLA and Shield Premium carries 99.99%.
RADIUSaaS states a log retention time of 75 days and publishes a service availability goal of 99.5% per calendar month, with service credits of 10% below 99.5% and 25% below 99.0%. Additional RadSec endpoints cost extra, and its server documentation states that RADIUSaaS does not fail over between them; your network equipment does.
Yes. You can start a 30-day Shield trial yourself, with every feature turned on and no credit card required, and every price is on the pricing page.
RADIUSaaS asks you to request a trial through a form on its website or by email, and for new customers buying through Microsoft Marketplace it asks you to allow up to one business day for provisioning.
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
If your organization runs on Microsoft Entra ID and Intune and you need both the certificate authority and the RADIUS service, Keytos Shield gives you both for less than RADIUSaaS plus SCEPman at list price, with network access that follows live Entra ID groups and Intune compliance, a 99.9% SLA, a year of logs and no minimum. Keytos is a member of the Microsoft Intelligent Security Association and also runs in Azure GCC High. If you only need RADIUS for a CA you already run, look at EZRADIUS, and if your users are not in Entra ID, RADIUSaaS is a sound choice.
It depends on what you need. If your organization runs on Microsoft Entra ID and Intune and you need both the RADIUS service and the certificate authority behind it, Keytos Shield covers both from $1.50 per user per month, with network access that follows Entra ID groups and Intune compliance. If you deploy Wi-Fi profiles from Google Workspace, want a European vendor with support in German, or only need RADIUS for a CA you already run, RADIUSaaS or Keytos EZRADIUS may be the better fit.
Shield costs less than RADIUSaaS plus SCEPman at their published list prices, at every size from 50 to 10,000 users. At 1,000 users, Shield is $1,045 USD a month for cloud RADIUS and cloud PKI together, while RADIUSaaS and SCEPman list at €784 and €523 a month, €1,307 in total, excluding sales tax. RADIUSaaS on its own does not include a certificate authority. If you only need RADIUS for a CA you already run, compare RADIUSaaS with Keytos EZRADIUS, which starts at $1 per active identity. See the full pricing comparison.
No. RADIUSaaS validates certificates from a CA you provide, such as SCEPman, Microsoft Cloud PKI or an on-premises PKI. glueckkanja sells SCEPman separately, or with RADIUSaaS in an Enterprise Bundle discounted by 25% against the separate prices, where SCEPman runs in your own Azure tenant on your own Azure bill, or in a SaaS Bundle. Keytos Shield includes an HSM-backed cloud PKI in its per-user price.
Yes. RADIUSaaS states that the minimum subscription is 50 users per organization, and that a user needs a licence if they are enabled to authenticate on at least one device, whether or not that device is in use. Keytos Shield has no minimum and covers unlimited devices and certificates per licensed user.
No. RADIUSaaS documents that it does not integrate with any identity provider for username and password network authentication, and that those accounts must be created and managed in the RADIUSaaS admin portal. Keytos Shield can validate passwords against Entra ID through EAP-TTLS, although we recommend certificate-based EAP-TLS wherever your devices support it, as RADIUSaaS does.
Yes. Keytos can trust certificates issued by the CA you already run, so devices keep connecting with their SCEPman certificates while Intune rolls out new Shield certificates through the same SCEP profiles. You can also chain the Shield SCEP CA up to an existing root CA.
Yes, on every authentication. Shield reads the user's current Entra ID group membership and the device's current Intune compliance state through Microsoft Graph, and can assign a VLAN per Entra ID group. The RADIUSaaS rule engine documents filters for certificate fields, usernames, SSIDs, switch MACs, NAS identifiers and IP addresses, and RADIUSaaS lists device compliance checks as a capability of its SCEPman bundles.
Keytos keeps network and audit logs for 1 year, included in the price, and can stream them to Microsoft Sentinel or any other SIEM. RADIUSaaS states a log retention time of 75 days, with export options for Azure Log Analytics, Microsoft Teams and a generic webhook.
Keytos Shield Basic carries a 99.9% uptime SLA, and Shield Premium carries 99.99%. RADIUSaaS publishes a service availability goal of 99.5% per calendar month, with service credits of 10% below 99.5% and 25% below 99.0%.
Shield includes BYOD onboarding through the Keytos Connect mobile and desktop app at no extra cost, so personal devices get certificates without an IT ticket. FIDO2 passkey and smart card onboarding is coming soon to the Shield base plan. RADIUSaaS covers BYOD and guest access through username and password accounts managed in its portal.
Start a 30-day Shield trial with every feature turned on, trust the certificates your devices already have, and test it on one SSID. No quote. No minimum. No trial request form. Cancel anytime.
