AuthPoint is WatchGuard's cloud-managed multi-factor authentication solution. Add a second layer of identity
verification to VPN logins, cloud apps, and workstations — no on-premises server required, with Mobile DNA matching to
block even cloned devices."
Expert Pre-Sales AdviceCertified reps reply in 1 hour.
Config & Managed ServicesSkip the setup. We'll do it.
POs · Tax-Exempt · Net 30Welcomed for Corp, Edu, & Gov.
Same-Day ShippingOrder by 3pm EST, ships today.
Specifications
AuthPoint at a Glance
Mobile DNA
AuthPoint's Mobile DNA fingerprints the physical device during enrollment. If someone clones the
authenticator app onto a different phone, the DNA signature won't match and the login attempt is
rejected. This goes beyond standard OTP-based MFA.
Cloud Management
AuthPoint runs entirely from WatchGuard Cloud. There is no on-premises authentication server to deploy,
patch, or maintain. Admins add users, configure policies, and review login activity from any browser.
SSO and Integrations
SAML 2.0 single sign-on is built in, with over 100 pre-configured connectors for popular cloud and
on-premises applications. Users authenticate once and move freely between connected apps without
repeated prompts.
Third-Party MFA
AuthPoint integrates with existing RADIUS, LDAP, and Active Directory environments. It layers on top of
your current infrastructure rather than replacing it, so VPN gateways and legacy apps get MFA protection
without a full migration.
Not sure which AuthPoint bundle fits your team?
AuthPoint is sold by user count in 1, 3, and 5-year terms. Compare license tiers side by side to find the
right fit for your organization's size and budget.
WatchGuard AuthPoint is a cloud-managed multi-factor authentication solution. It
requires users to verify their identity with a second factor, such as a push notification, one-time
password, or QR code, in addition to their regular password. AuthPoint protects VPN connections, cloud
application logins, and Windows and Mac workstation logins. Because it runs on WatchGuard Cloud, there
is no on-premises server to install or maintain.
When a user enrolls, AuthPoint records a DNA fingerprint of the specific mobile
device running the authenticator app. That fingerprint includes hardware and software characteristics
unique to the phone. If an attacker copies the authenticator app to a different device, the DNA
fingerprint will not match, and the authentication request is automatically blocked. This protects
against cloned-device attacks that can bypass standard OTP-based MFA.
Yes. AuthPoint integrates with VPN gateways through RADIUS, including WatchGuard
Firebox VPNs, Cisco ASA, Fortinet, Palo Alto, and others. When a user initiates a VPN connection,
AuthPoint sends a push notification to their phone. The user approves the request, and the VPN session
proceeds. The same flow works with OTP if push notifications are not available.
AuthPoint is primarily a software solution. Users install the AuthPoint mobile app
on their iOS or Android device and use push notifications, OTP, or QR code authentication. For users
who cannot use a smartphone, WatchGuard also offers a hardware token that generates time-based
one-time passwords. Both the mobile app and hardware token are managed from the same WatchGuard Cloud
portal.
AuthPoint is licensed on a per-user, per-year basis. You purchase seats for the
number of users who need MFA, and subscriptions are available in 1, 3, and 5-year terms. There are no
per-device fees. A single user license covers the user's mobile app, hardware token if applicable, and
all of the applications and resources they authenticate against through AuthPoint.
Ready to put MFA in front of every login?
Our certified WatchGuard reps can size an AuthPoint license for your team, walk you through deployment
options, and get you a quote the same day. No obligation.
