WatchGuard AuthPoint
Cloud MFA and identity security with push, passkeys, and zero trust policies
About WatchGuard AuthPoint
WatchGuard AuthPoint is a cloud-managed multi-factor authentication service that protects Windows and macOS logons, VPNs, and cloud applications with push approvals, QR codes, OTPs, and phishing-resistant FIDO2 passkeys. It is the identity layer of WatchGuard's Unified Security Platform, managed from the multi-tenant WatchGuard Cloud console, which makes it a common choice for MSPs and for businesses already running WatchGuard Firebox firewalls.
Pros & Cons
Pros
- Push approvals with Mobile Device DNA make logins quick for users and resist cloned-phone attacks
- Covers Windows and macOS logon, RDP, VPN, and cloud apps from one authenticator app
- Tight integration with WatchGuard Firebox for user- and group-based VPN MFA
- Multi-tenant WatchGuard Cloud console suits MSPs managing many customers
- Certified External MFA for Microsoft Entra ID without SAML federation
- Reviewers describe setup as straightforward and the per-user price as reasonable for MFA
Cons
- No public list price; you buy through WatchGuard partners or distributors
- Most valuable inside the WatchGuard ecosystem; less compelling as a standalone MFA
- Reviewers report occasional delayed push notifications on Android and extra pushes from the Windows logon app
- Some workflow gaps, such as no way to cancel a pending activation email and issues with usernames that contain spaces
- No free-forever plan beyond the 30-day trial
Key Features
Push, QR, and OTP authentication
Users approve logins with a push notification in the AuthPoint mobile app, scan a QR code, or enter a one-time password when offline.
Phishing-resistant FIDO2 passkeys
Passwordless sign-in with fingerprint or face scan that phishing pages and adversary-in-the-middle proxies cannot intercept.
Mobile Device DNA
Each authentication is bound to the enrolled phone's device fingerprint, so cloned devices are rejected automatically.
Zero trust adaptive policies
Risk-based policies evaluate device, location, network, and time context to decide whether to allow, challenge, or deny each login.
Microsoft Entra ID External MFA
Certified external MFA for Microsoft 365 and Azure in cloud-only and hybrid environments, without needing SAML federation.
Logon and VPN protection
Logon apps add MFA to Windows and macOS desktops and servers, RDP, and RADIUS-based VPNs including WatchGuard Firebox.
SSO application portal
SAML and OIDC single sign-on portal that gives users MFA-protected access to cloud apps, with 130+ prebuilt integrations.
Dark Web Credential Monitoring
Included in the Total Identity Security tier; alerts when company email domains and credentials appear in breach data.
Hardware tokens
OTP hardware tokens for users or environments where personal mobile devices are not permitted.
Multi-tenant WatchGuard Cloud management
One console to deploy and manage identity security across many customer accounts, alongside WatchGuard network and endpoint products.
Pricing
- Up to 250 users
- Full AuthPoint Total Identity Security feature set
- Activated in WatchGuard Cloud or via a partner
- Extendable once to 60 days
- Push, QR, and OTP authentication
- Mobile Device DNA
- FIDO2 passkeys
- SSO application portal
- Hardware token support
- External MFA for Microsoft Entra ID
- ThreatSync Credential Access
- WatchGuard Cloud management
- Everything in AuthPoint MFA
- Dark Web Credential Monitoring
- Detect exposed credentials before they are exploited
Best For
MSP-managed MFA for SMB clients
MSPs deploy and manage AuthPoint across many customer tenants from the WatchGuard Cloud console, often bundled with Firebox and endpoint services.
VPN and remote access protection
Adds push-based MFA to Firebox and other RADIUS VPNs so stolen passwords alone cannot open a remote session.
Windows and macOS logon MFA
Protects desktops, servers, and RDP sessions to block lateral movement with compromised credentials.
Microsoft 365 and Entra ID security
Uses Entra ID External MFA to put one MFA in front of Microsoft 365, Azure, and other apps.
Cyber insurance and compliance requirements
Meets MFA requirements from cyber insurers and frameworks with phishing-resistant passkeys and audit-ready policies.
Similar Tools
Devicie
Microsoft Intune deployment and automation at scale
1Password
The world's most-loved password manager for individuals, families, and businesses
Auth0
Developer-friendly authentication and authorization platform for any application
Hanko
Modern authentication with passkeys, on your terms
Keycloak
Open source identity and access management for modern applications
Okta
The World's Identity Company
Ready to try WatchGuard AuthPoint?
Start using WatchGuard AuthPoint today and boost your productivity.
Visit Website