WatchGuard AuthPoint

WatchGuard AuthPoint is a cloud-managed identity service that adds multifactor checks before users reach computers, VPNs, cloud services, and applications. It suits organizations and managed service providers securing a mix of cloud and on-premises access. Its breadth of factors and policy controls is a strong fit for hybrid environments, but per-user licensing and some network-side requirements make it less suited to buyers seeking a low-overhead, purely cloud deployment.

Overview

AuthPoint pairs WatchGuard Cloud administration with optional network components. It supports push notifications, one-time passcodes, QR codes, hardware tokens, and passkeys, so teams can accommodate different access situations and authentication preferences. Administrators can apply adaptive policies using signals such as device, location, time, and behavior; that flexibility is useful when access decisions need to reflect risk, though it also calls for deliberate policy setup.

WatchGuard says its FIDO2 passkeys are cryptographically bound to legitimate domains, helping guard against fake login pages capturing credentials. ThreatSync detects push abuse and can block tokens to address MFA fatigue. WatchGuard says its Identity Security aligns with NIST SP 800-63-4 authenticator assurance levels: FIDO2 passkeys deliver AAL2, while hardware-bound passkeys through YubiKey meet AAL3.

Key features

Authentication choices: Push, OTP, QR, hardware tokens, and phishing-resistant passkeys give organizations options for balancing user convenience with stronger verification. Passwordless authentication is supported.

Application access: An MFA-protected portal provides access to SAML and OIDC applications. AuthPoint also supports integrations through RADIUS, RESTful API clients, ADFS, RD Web, and Firebox, among other methods.

Broad integrations: WatchGuard says AuthPoint supports more than 130 third-party integrations, including VPNs, Microsoft Entra ID, and cloud applications. That breadth can help organizations cover varied systems without limiting protection to one application type.

Risk-based policies: Policies can consider device, location, time, behavior, and device DNA. These controls suit organizations that want access decisions to account for context rather than relying on a second factor alone.

Threat response: ThreatSync detects push abuse and blocks tokens automatically, addressing a common route for MFA fatigue attacks.

Microsoft Entra ID: External MFA for Entra ID is included in both AuthPoint MFA and Total Identity Security, but requires Entra ID P1 or higher. AuthPoint itself runs on WatchGuard Cloud independently of Entra ID licensing; the separate Entra requirement still matters for customers using External MFA.

Gateway connections: The optional AuthPoint Gateway connects the service to RADIUS clients, Active Directory or LDAP, and the ADFS agent. It runs on supported Windows Server versions, but cannot be installed on servers with FIPS mode enabled, a material constraint for some environments.

Pricing

AuthPoint is paid software with custom pricing through WatchGuard resellers. Licensing is per user, with term, subscription, trial, and service-provider NFR license types. AuthPoint MFA is billed per user for a one- or three-year period; volume discounts apply as the user base grows. Subscription licenses are invoiced monthly based on allocated users, which gives organizations a recurring billing option but makes user allocation relevant to the bill.

AuthPoint Total Identity Security includes MFA and Dark Web Monitoring and also requires a reseller quote. It is the plan to consider when both identity verification and dark web monitoring are needed; AuthPoint MFA is the narrower option for buyers focused on multifactor access.

There is no free plan. A 30-day free trial supports up to 250 users and includes the mobile authenticator, QR authentication, TOTP, mobile token PIN and biometric protection, the SSO portal, and zero trust risk policies. That is a substantial evaluation window and feature set, though teams above the 250-user cap cannot trial their full user base at once.

Platforms

AuthPoint supports Android, iOS, macOS, web, Windows, and API environments, with hybrid deployment. The mobile app requires Android 7.0 or higher or iOS 14.0 or higher. WatchGuard Cloud provides administration, including multi-tenant management for service providers. The Gateway adds a Windows Server dependency for connections to supported on-premises systems, so organizations should account for server compatibility before choosing that integration path.

Who it's for

AuthPoint is best suited to organizations protecting users across cloud applications, VPNs, and on-premises systems, especially where multiple authentication factors or contextual access policies matter. Managed service providers may benefit from WatchGuard Cloud's multi-tenant management for handling multiple customer accounts. Buyers whose priority is a straightforward cloud-only setup should weigh the added Gateway deployment where RADIUS, directory, or ADFS connectivity is required.

WatchGuard advertises 24x7 expert support and 24x7 priority technical support. Its cloud information security management system is certified to ISO/IEC 27001:2022 within the scope described by WatchGuard.

Pros and cons

Pro: A choice of push, OTP, QR, hardware tokens, and passkeys supports different user needs and includes phishing-resistant authentication.

Pro: More than 130 third-party integrations and SAML/OIDC portal access suit organizations with varied applications and network access requirements.

Pro: Device, location, time, and behavior signals let administrators tailor access policies, while ThreatSync addresses push-abuse attacks.

Pro: Multi-tenant management is useful for service providers managing separate customer accounts.

Con: Per-user reseller pricing requires a quote, so buyers need to confirm costs against their user allocation and contract term.

Con: The Gateway requires supported Windows Server for certain connections and is incompatible with FIPS mode, limiting deployment options in affected environments.

Con: External MFA for Entra ID requires Entra ID P1 or higher, adding a Microsoft licensing condition for that use case.

Alternatives

For a broader comparison, browse Multi-Factor Authentication Software or Authenticator apps. If the priority is firewall administration rather than identity verification, see Firewall Management Software.

ManageEngine Firewall Analyzer is a paid alternative with a free trial; its Standard Edition costs $395 a year and supports up to 60 devices, making it relevant when firewall traffic analysis and device limits are central to the decision.

WatchGuard FireCloud is another paid WatchGuard option with a free trial. Its Internet Access plan for 1–50 licenses costs $97.75 a year, so it may suit buyers specifically comparing that internet-access offering rather than AuthPoint's MFA functions.

SonicWall Network Security Manager offers a free plan for centralized management and alerting with SonicWall firewall support; consider it when that firewall-management scope is the need.

CacheGuard-OS is a freemium Linux and self-hosted option with a free plan, for readers comparing that category of deployment.

Comodo Internet Security offers a free plan and a Pro plan at $39.99 a year; it is an alternative to consider when its Windows security software is the relevant category.

Google Cloud Firewall Policies includes Cloud NGFW Essentials free, with rules based on standard network attributes such as IP ranges, ports, and protocols; it is relevant when cloud firewall policy is the requirement.

Stormshield Management Center is a paid option with a trial version available by contacting sales. Check Point DDoS Protector is another paid security product to compare.

Verdict

Choose AuthPoint if your organization or MSP needs MFA across cloud and on-premises access, values multiple authentication methods, and can use its contextual policies and broad integration support. The main reason to choose it is the combination of passkeys, risk-based controls, and integration breadth under cloud management. Look elsewhere if reseller-quoted per-user costs, Entra ID P1 requirements for External MFA, or the Windows Gateway constraints do not fit your budget or environment.