WatchGuard AuthPoint

WatchGuard AuthPoint is a cloud-based multifactor authentication service that checks users before they access computers, VPNs, cloud services, and applications. Users can verify with push notifications, one-time passcodes, QR codes, hardware tokens, or phishing-resistant passkeys. Its access policies can consider device, location, and behavior, and an application portal provides access to SAML and OIDC applications. WatchGuard lists more than 130 third-party integrations, including VPN, Microsoft Entra ID, and cloud applications. AuthPoint is managed through WatchGuard Cloud, which supports multi-tenant administration for service providers. An optional Gateway connects the service to RADIUS clients, Active Directory or LDAP, and the ADFS agent. That Gateway cannot be installed on Windows servers with FIPS mode enabled. AuthPoint has no free plan; pricing is available from a WatchGuard reseller, and the free trial lasts 30 days for up to 250 users. The mobile app supports Android 7.0 and higher and iOS 14.0 and higher.

AuthPoint offers multiple verification methods alongside adaptive access policies and integrations. Organizations should account for its per-user licensing and the Gateway restriction if their setup requires that component.

AuthPoint suits organizations and managed service providers that need multifactor authentication across connected services. Its multi-tenant administration is relevant to service providers managing multiple customer accounts.

WatchGuard AuthPoint is a cloud-managed service that verifies users before they reach computers, VPNs, cloud services and applications. It suits organizations and managed service providers securing a mix of cloud and on-premises access. Its broad authentication choices and policy controls are compelling, but per-user licensing and the Gateway requirement for some connections add cost and deployment considerations.

Overview

AuthPoint pairs administration through WatchGuard Cloud with authentication methods ranging from push notifications and one-time passwords to QR codes, hardware tokens and passkeys. Teams can select methods for different users and access situations rather than relying on one factor. Access policies can consider device, location, time and behavior, giving administrators tools to weigh context when granting access.

WatchGuard says its FIDO2 passkeys are cryptographically bound to legitimate domains, helping prevent fake login pages from capturing credentials. ThreatSync detects push abuse and blocks tokens to address MFA fatigue attacks. WatchGuard says its Identity Security aligns with NIST SP 800-63-4 authenticator assurance levels: FIDO2 passkeys deliver AAL2, while hardware-bound passkeys via YubiKey meet AAL3.

Key features

• Cloud and on-premises access: AuthPoint supports more than 130 third-party integrations, including VPN, Microsoft Entra ID and cloud applications. SAML and OIDC support access through its MFA-protected application portal; additional integration methods include RADIUS, RESTful API client, ADFS, RD Web and Firebox. That breadth suits mixed environments, but some connections depend on an on-premises Gateway.
• Adaptive controls: Risk policies can use factors such as device DNA, location and time to inform access decisions. This is useful for organizations that want policy to respond to context, though it calls for more administration than a uniform sign-in rule.
• MSP management: WatchGuard Cloud supports multi-tenant administration, letting service providers manage multiple customer accounts. WatchGuard advertises 24x7 expert support and 24x7 priority technical support.
• Microsoft Entra ID: External MFA for Entra ID is included in both AuthPoint MFA and Total Identity Security, but requires Entra ID P1 or higher. AuthPoint runs on WatchGuard Cloud independently of Entra ID licensing; this distinction matters to organizations comparing its licensing with Microsoft's prerequisite.
• Gateway caveat: The optional AuthPoint Gateway connects the service to RADIUS clients, Active Directory or LDAP, and the ADFS agent. It runs on supported Windows Server versions, but cannot be installed on Windows servers with FIPS mode enabled. Organizations that need those connections should check this restriction before choosing AuthPoint.

Pricing

AuthPoint is paid software with per-user licensing. Subscription licenses are invoiced monthly according to user allocation, with volume discounts as the user base grows; term licenses are available for one or three years. Service-provider NFR licenses are also offered. The pricing model makes the cost depend on the number of users, so teams should compare a quote against their expected allocation rather than assume a fixed site-wide fee.

• AuthPoint MFA: Custom pricing through a WatchGuard reseller, billed per user for a one- or three-year period. It covers MFA; per-user licensing and volume discounts make it the relevant option for organizations seeking authentication without the additional Dark Web Monitoring in the higher tier.
• AuthPoint Total Identity Security: Custom pricing through a WatchGuard reseller. It includes MFA and Dark Web Monitoring, making it the broader choice for organizations that want both under the same plan.

There is no free plan. The 30-day trial can enroll up to 250 users and includes the mobile authenticator, QR authentication, TOTP, mobile token PIN and biometric protection, the SSO portal and zero trust risk policies. That cap gives a sizable team room to evaluate core workflows, but the trial does not remove the need to price ongoing per-user licensing.

Platforms

AuthPoint supports Android, iOS, macOS, web, Windows and API access, with hybrid deployment. Its mobile app requires Android 7.0 or higher or iOS 14.0 or higher. The Gateway's Windows Server requirement is relevant specifically to organizations connecting the service to supported on-premises systems.

Who it's for

AuthPoint is a strong fit for organizations and MSPs that need several authentication methods, adaptive access rules and integrations across cloud and on-premises systems. Its multi-tenant management is particularly relevant to service providers, while passkeys and ThreatSync's push-abuse response address phishing and MFA fatigue concerns. It is a weaker fit for teams that need RADIUS, directory or ADFS connections but cannot accommodate the Gateway, especially where FIPS mode is enabled on Windows servers.

Pros and cons

• Pros
  • Passkeys, hardware tokens, push, OTP and QR provide options for different access and assurance needs.
  • Risk policies can evaluate device, location, time and behavior instead of applying the same access decision in every situation.
  • More than 130 integrations and SAML/OIDC portal access suit organizations with varied application environments.
  • Multi-tenant WatchGuard Cloud administration supports MSPs managing multiple customers.
  • A 30-day trial for up to 250 users includes SSO and zero trust policies, providing room to assess more than basic authentication.
• Cons
  • Per-user licensing and custom quotes make costs dependent on user allocation and require reseller pricing.
  • RADIUS, directory and ADFS connections may require a Windows Server Gateway, which adds an on-premises component.
  • The Gateway cannot run on Windows servers with FIPS mode enabled, limiting deployment options for affected environments.
  • External MFA for Entra ID requires Entra ID P1 or higher, even though AuthPoint itself runs independently of Entra ID licensing.

Alternatives

For readers comparing adjacent security tools, the right alternative depends on whether the need is identity access or network protection:

• Multi-Factor Authentication Software is a useful category comparison for organizations weighing AuthPoint against other MFA products.
• Authenticator apps is relevant for readers focused on authenticator applications rather than an organization-wide, cloud-managed MFA service.
• Firewall Management Software is the better category to explore when the central requirement is managing firewalls rather than verifying user access.
• Forcepoint Next Generation Firewall is an alternative to consider for firewall deployments across physical, virtual and cloud environments.
• ManageEngine Firewall Analyzer may suit readers seeking firewall analysis with a published Standard Edition price of $395 a year for up to 60 devices.
• WatchGuard FireCloud is worth comparing when the need is WatchGuard's internet-access offering, with a one-year, 1–50 license plan priced at $97.75 a year.
• ZoneAlarm Extreme Security NextGen is another security product to compare.
• Comodo Internet Security may appeal to Windows users considering a freemium security product, with a free plan and a Pro plan priced at $39.99 a year.
• CacheGuard-OS offers a free, self-hosted option for Linux and web environments; its free capacity is selected during setup, and excess capacity can slow or block traffic.
• Google Cloud Firewall Policies is a free alternative to explore for cloud firewall rules based on network attributes such as IP ranges, ports and protocols.
• SonicWall Network Security Manager may fit readers looking for centralized firewall management and alerting included with SonicWall firewall support.

Verdict

Choose AuthPoint if your organization or MSP needs flexible MFA, contextual access policies and integrations spanning cloud and on-premises systems. Its strongest case is the combination of passkeys, multiple factors, threat response and multi-tenant management. Look elsewhere if per-user custom pricing is a poor fit or your required Gateway deployment conflicts with FIPS mode or your infrastructure plans.