WatchGuard AuthPoint

WatchGuard AuthPoint protects workforce logins to desktops, VPNs, and cloud applications, from Windows and macOS sign-in to Microsoft 365 and third-party SaaS. It runs on WatchGuard Cloud, the same console that manages WatchGuard network and endpoint security. An MSP or an IT team can cover identity without adding another vendor to the stack.

When MFA alone is not enough

Day-to-day authentication runs through the AuthPoint mobile app, with push, QR code, or one-time password. QR and OTP work when the device has no network connection. Push notifications and passcodes can still be intercepted, or approved by a tired user. FIDO2 passkeys close that gap: a passkey works on the real login page and fails on a fake one. Each token is bound to the device that registered it, a mechanism WatchGuard calls Device DNA, so a copied token stops working. When someone floods a user with approval requests, ThreatSync, the correlation layer built into WatchGuard Cloud, detects the push abuse and can block the user or the source IP.

Where it applies

Windows and macOS logon, VPN and firewall access, and an SSO portal, with documented integrations for more than 130 third-party products across SAML, OIDC, and RADIUS. A WatchGuard firewall is not required: published integration guides cover Fortinet, SonicWall, Sophos, Palo Alto Networks, Cisco, and Check Point, among others. Passwordless sign-in with Windows Hello and macOS Touch ID is supported, and MFA can be required when a user elevates to administrator rights. Hardware tokens are available for users who cannot use a phone.

Microsoft environments

AuthPoint acts as external MFA for Microsoft Entra ID. That is the one capability that requires an Entra ID P1 license. Everything else runs on any Microsoft 365 plan. Deployment does not depend on how a customer licenses Microsoft.

User directories

Users synchronize from Active Directory, Microsoft Entra ID, or LDAP. A built-in cloud directory covers customers running none of the three, which is often the case in smaller organizations.

Managed alongside network and endpoint security

AuthPoint is multi-tenant from the first login, so a service provider adds a customer without standing up a separate instance. Identity events feed ThreatSync alongside network and endpoint data, so a suspicious login is seen next to what happened on the device and on the network.

What it costs

AuthPoint is priced per user, not per feature or per token, and WatchGuard sets no minimum user count. A 20-person firm and a 5,000-user enterprise get the same authentication set, so security does not depend on which tier a customer can afford. Subscription licensing removes the allocation step entirely: WatchGuard bills monthly through the distributor for active users, and a provider can set a limit on any managed account. A 30-day trial is available, and the authentication service carries a 99.99% uptime SLA.

Two license options

AuthPoint Multi-Factor Authentication covers authentication. AuthPoint Total Identity Security includes everything in the MFA product and adds Dark Web Credential Monitoring, which flags corporate and personal credentials found in breach data before an attacker uses them. An account runs on one license or the other.

Compliance

AuthPoint is delivered from WatchGuard Cloud, which is ISO/IEC 27001:2022 certified. FIDO2 passkeys meet AAL2 under NIST SP 800-63-4, the standard's authenticator assurance levels, and hardware-bound passkeys meet AAL3 for privileged users.