AuthPoint

The Identity Provider Behind Every Sign-In

AuthPoint protects the moment a user signs in and everything that depends on it: MFA or passkey to verify them, single sign-on to their apps, and only the access your policies allow. One identity service, standardized across customers.

See the Demo Get Pricing
WatchGuard AuthPoint screens on laptop and mobile devices

Built to Protect How Your Users Actually Work

Multi-Factor Authentication

Push notification, QR code, one-time code, or hardware token. The mobile app's token is tied to the real device, so cloned phones are rejected.

Phishing-Resistant Passkeys

No passwords. No codes. On web applications, users verify with a fingerprint or face scan that phishing pages cannot intercept.

Works Where Your Users Sign In

Windows and macOS sign-in, VPNs and RADIUS, remote desktop, Microsoft 365, and cloud apps, whether users are in the office or remote.

Microsoft Entra ID
External MFA

One MFA for Microsoft 365, another for VPNs and computers? Add AuthPoint to Entra ID as an External MFA provider and use one for both.

Zero Trust Policies

Every sign-in is evaluated in context: network location, time, geofence, and impossible travel decide whether access is granted.

Single Sign-On and Directory

One SSO portal for SAML and OIDC apps, with users and groups from Active Directory, LDAP, Entra ID, or WatchGuard Cloud Directory.

 
 
 
 
 

Will AuthPoint Fit Your Environment?

Learn what AuthPoint is, where it runs, how users sign in, how it works with Microsoft 365, and what to do for users without a phone.

AuthPoint is WatchGuard’s cloud identity provider, and the identity management service behind both AuthPoint plans: multi-factor authentication, single sign-on, and zero trust policies across computers, VPNs, Microsoft 365, and cloud apps, managed from WatchGuard Cloud. For cloud-only environments there is nothing to install on-premises: configure users, enroll their mobile tokens, and start protecting sign-ins the same day.

Yes. AuthPoint adds MFA to Firebox VPNs natively, and to other VPNs and network devices through RADIUS using the AuthPoint Gateway, a small service installed on a server on the network. Everything is managed from the same WatchGuard Cloud console.

Push, QR code, and one-time code from the AuthPoint mobile app, hardware OTP tokens, and FIDO2 passkeys. All of them except passkeys work everywhere AuthPoint does, including Windows and macOS sign-in and VPNs; passkeys work on web applications, Microsoft 365 through External MFA, and FireCloud, our cloud access service, from a single enrollment.

Yes. AuthPoint plugs into Entra ID as an External MFA provider (Entra ID P1 or higher), so one MFA covers Microsoft 365, Azure, and your other apps; without P1, Microsoft 365 can be federated with AuthPoint instead. Microsoft Authenticator is built for Microsoft sign-ins; AuthPoint also covers VPNs, computers, and third-party apps.

Yes. AuthPoint hardware tokens generate a one-time password every 30 seconds with no mobile device and no app, and work at the computer sign-in prompt, on VPNs, and with Microsoft Entra ID External MFA.

Doctors in lapcoats sitting around a table with tablets and laptops
AuthPoint was rather simple to install on our network, thanks to the help of technical support. Combined with the simplicity for our employees, it was easy to use from the very start.

Kostantinos Theodorou,

Systems Administrator, MedNet

Read the Story

Start Protecting Every Sign-In Today

See how AuthPoint fits your environment, from computer sign-in to Microsoft 365 and cloud apps.

Try Now