In short: WatchGuard AuthPoint is cloud-based multi-factor authentication licensed per user. Users approve sign-ins with push notifications, QR codes, one-time passwords or passkeys, or use hardware tokens. It protects VPNs and RADIUS clients, Windows and macOS logons, Remote Desktop, ADFS and SAML cloud apps. Total Identity Security adds dark web credential monitoring.
What AuthPoint is
AuthPoint is WatchGuard's multi-factor authentication (MFA) service. It is hosted in WatchGuard Cloud, so there is no authentication server to build, and it asks users to prove who they are with something on their phone before they can sign in to a protected resource. Stolen passwords alone stop being enough.
AuthPoint works with any network, not only WatchGuard ones, but it integrates particularly well with Firebox VPNs, FireCloud and Total MDR, which can watch AuthPoint sign-ins for suspicious activity.
Authentication methods
- Push notifications: the user approves or denies a sign-in in the AuthPoint mobile app.
- QR codes: the user scans a code with the app, which works when the phone has no data connection.
- One-time passwords: time-based codes from the app or from a hardware token.
- Passkeys: passwordless sign-in using the device's own unlock method.
AuthPoint ties each software token to the phone it was activated on, using what WatchGuard calls mobile device DNA, so copying the app to another device does not copy the token. Hardware tokens can be issued to staff who cannot or will not use a personal phone, and zero trust policies can restrict sign-ins by conditions such as location or time.
What AuthPoint protects
| Resource | How it connects |
|---|---|
| Windows and macOS computer logons, including RDP and RD Gateway | AuthPoint Logon app on the computer or server |
| Remote Desktop Web Access | RD Web agent |
| VPNs and other RADIUS clients, including Firebox | AuthPoint Gateway on your network |
| ADFS | ADFS agent, with the AuthPoint Gateway |
| Cloud apps that support SAML | Direct integration, with single sign-on through the AuthPoint portal |
| Microsoft Entra ID | Entra ID external MFA integration |
Users can come from Active Directory or other LDAP directories, synchronised through the AuthPoint Gateway, or from the WatchGuard Cloud Directory. WatchGuard publishes integration guides for many common VPNs and cloud services.
How AuthPoint is licensed
AuthPoint is licensed per user, whatever number of resources each person signs in to. There are two products:
| Product | Includes |
|---|---|
| AuthPoint Multi-Factor Authentication | All the MFA features above |
| AuthPoint Total Identity Security | Everything in AuthPoint MFA plus Dark Web Credential Monitoring, which alerts administrators, and optionally users, when staff credentials appear in breach data |
A WatchGuard Cloud account for a single organisation holds one AuthPoint product at a time, and adding users or extending the term modifies that licence. Ask us for a quote, and tell us if you are interested in Total Identity Security.
Deployment and requirements
Users install the free AuthPoint app on iOS or Android and activate a token from an email. The AuthPoint Gateway, a small application on a Windows server on your network, is needed for RADIUS clients, for synchronising users from Active Directory or LDAP and for ADFS; cloud apps used only by WatchGuard Cloud Directory users do not need it. Most organisations roll out in stages: VPN and remote access first, then Microsoft 365 and other cloud apps, then computer logons.
Who it suits and how we help
AuthPoint suits small and mid-sized organisations that need MFA on remote access to meet Cyber Essentials or cyber insurance requirements, particularly those with Fireboxes or a mix of on-premises and cloud systems. We plan the rollout, install the Gateway, connect your directory and resources, and help staff enrol. Compare options in identity, MFA and privileged access.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is AuthPoint licensed per user?
Yes. Each user who authenticates with AuthPoint needs a licence, however many resources they sign in to.
What is the difference between AuthPoint MFA and Total Identity Security?
Total Identity Security includes everything in AuthPoint Multi-Factor Authentication plus Dark Web Credential Monitoring, which scans breach data for exposed staff credentials and alerts you so passwords can be changed.
Does AuthPoint work without a WatchGuard firewall?
Yes. AuthPoint works with third-party VPNs through RADIUS, with SAML cloud apps, with Microsoft Entra ID and with Windows and macOS logons, as well as with Fireboxes.
Can AuthPoint protect Remote Desktop?
Yes. The AuthPoint Logon app adds MFA to RDP and RD Gateway connections, and an RD Web agent protects Remote Desktop Web Access.