Solutions
One platform. Zero passwords.
Cloud PKI for Azure, Intune, and Entra ID
The best cloud RADIUS for Microsoft environments
Entra ID authentication to SSH endpoints
Passwordless security key and smart card onboarding for Entra ID
Eliminate SSL certificate outages and vulnerabilities
Blog
Partner
Your trusted partner for passwordless security
Join our global partner network
For organizations on Microsoft Entra ID and Intune, Keytos Shield gives you the same certificate-based network access as SecureW2 JoinNow, priced per user instead of per device, month to month instead of on a 12-month contract.
1,200+
Global organizations
trust Keytos
45M+
RADIUS authentications
per month in EZRADIUS
7.3M+
Cryptographic operations
per month in EZCA
20+
Deployment regions
around the globe
SecureW2 JoinNow and Keytos Shield are very similar capability by capability; the differences are mainly in pricing, government cloud support, and native integration with Microsoft Entra ID and Intune, which gives Keytos an edge.
| Capability | |
SecureW2 JoinNow |
|---|---|---|
| Pricing | $1.50 per user per month, or less See pricing by company size |
Quote only. $5.39 per device per year on AWS Marketplace |
| Cloud PKI and cloud RADIUS in one subscription | Yes, at one per-user price (You can also purchase EZCA and EZRADIUS individually). | Yes |
| Passwordless Wi-Fi, wired 802.1X, and VPN with EAP-TLS | Yes, certificate-first | Yes, certificate-first |
| Network policy from identity and device compliance | Yes, with live Entra ID group and Intune compliance checks on every authentication | Yes |
| HSM-backed certificate authorities | Yes, FIPS 140-3 Level 2, or Level 3 on Premium | Yes, FIPS level not stated publicly |
| Automated issuance, renewal, and revocation | Yes, through Intune SCEP, Jamf, and ACME, plus EST, Azure Key Vault, and CLI with EZCA | Yes, just for managed devices through MDM and identity provider integrations |
| G2 review score | 4.8/5 | 4.7/5 |
| Published customer count | 1,200+ | 1,000+ |
| Self-service, fully featured, 1-month free trial | Yes, with no credit card or sales call required | No, demo through sales calls |
| Minimum users or long-term contract | None. Start with one user and cancel at any time | 100 devices and a 12-month, non-cancellable contract on AWS Marketplace |
| Deploy and bill through the Azure Marketplace | Yes, deploy in a few clicks | No. Listed, but "contact me" only |
| Azure GCC High support | Yes, at no additional cost | No public documentation |
| SOC 2 Type II and ISO 27001 certification | Yes, SOC 2 Type II and ISO 27001 | SOC 2 and ISO 27001. SOC 2 type not stated publicly |
| BYOD mobile and desktop app | Yes, Keytos Connect, included with Shield at no extra charge | Yes, JoinNow MultiOS |
| Passwordless onboarding for FIDO2 passkeys and smart cards | Yes, included with Shield Basic at no extra cost | Smart card certificates on YubiKeys. FIDO2 passkey enrollment not documented |
| SSH certificates for GitHub and Linux | Yes, with EZSSH | Described in a blog post, not listed in any plan |
| Azure Key Vault certificates | Yes, with EZCA | No public documentation |
| Azure IoT Hub device certificates | Yes, with EZCA | No public documentation |
Keytos and SecureW2 are usually referred as the leaders in the passwordless access space, from cloud RADIUS to passwordless onboarding. However, While SecureW2 focused on servicing all identity providers such as Google and Okta, Keytos focuses on being the best option for Microsoft Entra ID customers. This makes SecureW2 a better solution for organizations that use Google or Okta. However, if you are a Microsoft customer, Keytos does not stop at simple RADIUS authentication and SmartCard management, instead is a full passwordless identity platform including all the places where Entra ID lacks support, such as just-in-time access to SSH resources including GitHub, and full PKI and certificate management support for Servers, Azure Services, and IoT devices making it your one stop solution for passwordless access and identity management in Entra ID.
Yes. Keytos Shield is a subscription that covers an HSM-backed cloud PKI, cloud RADIUS with classic RADIUS and RadSec endpoints, Smartcard and Passkey onboarding/management, and it even includes the Keytos Connect app for personal and BYOD devices; at one per-user price that starts at $1.50 per user per month. Making it the most comprehensive RADIUS bundle in the market while still being the lowest cost RADIUS provider.
However, you are not forced to take the whole bundle. If you already run a certificate authority, EZRADIUS is cloud RADIUS by itself from $1 per active identity. If you already have RADIUS included with your network provider, such as Cisco ISE, and you only need a CA, EZCA will cover your whole organization starting at $200 USD per CA with no additional cost or hidden fees.
Yes. In fact, Keytos was built by ex-Microsoft cloud PKI engineers, and EAP-TLS is how Keytos recommends setting up network authentication (even for the BYOD application Keytos Connect that uses Entra ID to authenticate the user, it uses a certificate in the background to authenticate the device/user to the network). Keytos Shield handles the whole process for you from creating the certificate authority to the creation of the RADIUS profiles all in less than 10 minutes. Watch this video to see how easy it is to setup.
While we recommend using EAP-TLS wherever possible, for the printers, cameras, and legacy devices every real network still has, Keytos also supports PEAP, MS-CHAPv2, PAP, and MAC authentication bypass.
In Keytos Shield the certificate authority and the RADIUS server are one product: one subscription, one onboarding flow, and one bill. It is all handled for you meaning that you don't have to create the CA and then go to the RADIUS server and add the trust, the onboarding guide will ask you some questions about your environment and configure everything automatically.
For organizations that are migrating from an existing EAP-TLS deployment, Shield also works with the certificates you already have. It trusts certificates from Microsoft AD CS, Microsoft Cloud PKI, or any third-party CA, and it can chain its own CA up to your existing root, so adopting it does not mean re-issuing every certificate on day one.
Yes. EZCA handles issuance, automatic renewal, and revocation, and publishes CRLs and OCSP for every certificate authority it runs. Certificates reach managed devices through Intune SCEP (EZCA is one of the third-party CAs listed in Microsoft's own Intune SCEP documentation), Jamf, and ACME, and reach personal devices through Keytos Connect.
Revocation is enforced where it counts. On every certificate authentication, Keytos checks the certificate against its CA's revocation list so a revoked certificate stops getting onto the network at its next connection, and if you do not want to wait for a new CRL to be published, Keytos can also check the values of your certificate against your Entra ID and Intune tenant giving you true Zero-trust authentication into your network. As previously mentioned, Keytos certificate expertise goes beyond the network, EZCA issues and manages internal certificates with Azure Key Vault, Azure IoT, and it can also help you meet with the 47 certificate mandate by helping you automate public certificate issuance and management across your organization.
Yes. On every authentication, not just when a certificate is issued, Keytos checks the user's current Entra ID group membership and the device's current Intune compliance state. A laptop that falls out of compliance, or a user removed from a group, loses network access at the next connection even though the certificate on the device is still valid.
Policies are built from the Entra ID groups and Intune compliance policies you already manage. There is no directory sync and no middleware in between.
Network access is rarely the only place an organization needs certificates, so Keytos covers the rest as well. Passwordless onboarding for FIDO2 passkeys and smart cards is included in the basic plan. Engineers can also get short-lived SSH certificates for Linux and GitHub, services get TLS certificates that renew themselves in Azure Key Vault, and IoT fleets get device identity.
With Keytos, all of that comes from one vendor, one security review, and one stream of logs into your SIEM.
Yes. Every Keytos price is on keytos.io, the tiers get cheaper as you grow, and the calculator below gives you your monthly cost in seconds. Keytos Shield is month to month, with no minimum, and you can cancel at any time.
As of September 27, 2026, Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products, including 21 for EZRADIUS and 20 for EZCA, each rated 4.8, making it the highest rated in its category.
SecureW2 does not list prices on its website. You request a quote and go through a scoping call before you see a number. Its only public price is an AWS Marketplace listing. Keytos publishes every price. Here is how the two compare on the terms that decide what you actually pay.
| Pricing term | |
SecureW2 JoinNow |
|---|---|---|
| List price | Starts at $1.50 per user per month with no minimum number of users | $5.39 per device per year on AWS Marketplace, with a 100-device minimum and 12-month contract |
| Price published on the vendor's website | Yes, every plan and tier | No, quote form only |
| What you pay for | Each licensed user, with unlimited certificates and devices | Each device that receives a certificate |
| Minimum purchase | None. Start with one user | 100 devices |
| Contract | Month to month. Cancel at any time | 12 months, with fees that are non-cancellable and non-refundable |
| Free trial | 30 days, self-service, no credit card | None. Demo through sales |
A very simple architecture product that delivers on promises - we haven't had a single WiFi failure since we migrated. No downtime during transition, and the pricing let us finally move away from legacy ISE.
EZCA is the only CA platform that is actually native to Azure, enabling easy PKI deployment for PIV authentication without standing up Windows Server VMs - much cleaner and easier to deploy.
Ease of implementation and ease of use during operations. We use EZRADIUS for 802.1x authentication on wired and wireless LANs - it's significantly improved our infrastructure security and given us confidence in access control across our networks.
Easy to use, with quick and knowledgeable support via chat and helpful documentation for third-party integrations. Setup required minimal effort, and the EZCA/EZRADIUS/Intune integration was key for CMMC compliance.
No server deployment needed for wireless authentication with Entra credentials - straightforward setup, and the organization eliminated its on-premises RADIUS server entirely by moving to a fully cloud-based infrastructure.
Eliminates the need to stand up and maintain a traditional on-prem PKI/CA infrastructure for 802.1X, with fully automated certificate issuance and renewal through Intune SCEP integration.
For organizations that run on Microsoft Entra ID and Intune, Keytos is the stronger choice. It matches SecureW2 on the core capabilities and surpasses it in several areas: Azure GCC High support, native Entra ID, Jamf, and Intune integration, and since Keytos is a Microsoft partner and part of the Microsoft Intelligent Security Association, you can pay through the Azure Marketplace if desired.
Keytos. Keytos Shield was built by ex-Microsoft engineers on Entra ID and Intune. It checks Entra ID group membership and Intune compliance live on every network authentication, deploys and bills through the Azure Marketplace, and runs in Azure GCC High at no extra cost. SecureW2 supports Entra ID and Intune as one of several identity providers rather than the platform it is built on.
SecureW2 does not list prices on its website, so you get a quote after a sales conversation. Its AWS Marketplace listing prices JoinNow at $5.39 per device per year, with a 100-device minimum and a 12-month contract that cannot be cancelled or refunded, and Vendr reports a median SecureW2 purchase of $16,840 a year. Keytos Shield is priced per user rather than per device. It starts at $1.50 per user per month for cloud PKI and cloud RADIUS together, falls to $0.15 per user above 10,000 users, and has no platform fee, no minimum, and no long-term contract. See the full pricing comparison.
Yes. Keytos Shield is one subscription that includes an HSM-backed cloud PKI, cloud RADIUS with RadSec, and the Keytos Connect app for BYOD devices, at one per-user price. Passwordless onboarding for FIDO2 passkeys and smart cards is coming to Shield Basic at no extra cost. If you only need one half, EZCA (cloud PKI) and EZRADIUS (cloud RADIUS) are also sold on their own.
Yes. EAP-TLS certificate authentication is the core of Keytos Shield. Its built-in certificate authority issues device and user certificates through Intune, Jamf, or the Keytos Connect app, and its cloud RADIUS service validates them for Wi-Fi, wired 802.1X, and VPN. Older protocols such as PEAP and MAC authentication bypass are there for devices that cannot hold a certificate, and password authentication applies only on the access policies where you turn it on.
As of September 27, 2026, Keytos has 43 reviews on G2 averaging 4.8 out of 5 across its products, including 21 for EZRADIUS and 20 for EZCA, and Keytos products hold the G2 High Performer (Fall 2026) and Users Love Us badges, making it the highest-rated score in its category on G2.
No. Keytos is built by ex-Microsoft engineers for Microsoft Entra ID, in commercial, GCC, and GCC High tenants, and builds network policy from Entra ID groups and Intune compliance. Devices managed through Intune, Jamf, and other MDM platforms can all receive Keytos certificates, but user identity and group policy come from Entra ID.
Yes. Keytos can trust certificates from other certificate authorities, so you can run it alongside SecureW2 while your MDM rolls out new Keytos certificates through the same Intune or Jamf profiles. Devices move over as they re-enroll, which means the migration happens on your schedule rather than in a single cutover.
Yes. Keytos is SOC 2 Type 2 certified and ISO 27001 compliant, its certificate authorities run on FIPS 140-3 validated HSMs, and every Keytos product sends its security logs to Microsoft Sentinel or any other SIEM so your SOC team keeps its own record of what happened.
No. Keytos Shield is billed for the users you license, with no platform fee and no minimum, and you can cancel at any time. You can also deploy it from the Azure Marketplace and bill it to your Azure subscription.
Yes. You can start a 30-day trial of the Keytos Toolset with every feature turned on, enabling you to explore its full capabilities before making a commitment or even talking to sales.
Yes. While Keytos solutions are accessible to organizations of all sizes, all Keytos solutions are designed to support large enterprises, providing scalable and robust security features suitable for complex organizational environments.
As a security provider, Keytos maintains a strict policy of not publicly disclosing specific customer information. However, more than 1,200 organizations across a wide range of industries and company sizes worldwide trust Keytos to secure their environments.
Keytos is also an active and recognized participant in leading industry programs and organizations that set the industry standards such as the FIDO Alliance and the Microsoft Intelligent Security Association (MISA).
Keytos was built from the ground up to be a cloud first multi-tenant solution that minimizes infrastructure costs and simplifies deployment, making it significantly more affordable than traditional solutions that require extensive hands on onboarding and dedicated hardware.
Start a 30-day trial with every feature turned on. No hardware investment. No long-term contracts. No hidden fees. Just pay for the users who connect, and cancel anytime.
