WatchGuard AuthPoint: MFA for SMBs, VPN, Microsoft 365 and endpoints

The short answer: AuthPoint is WatchGuard’s multi-factor authentication (MFA) service, fully managed from WatchGuard Cloud. Your staff install a single mobile app, and that app approves their sign-ins to the Firebox VPN, their Windows or macOS session, remote desktop, SAML-compatible web applications and Microsoft 365. For an SMB that already runs a WatchGuard firewall, it is the most direct way to put MFA everywhere, with a single console and access rules per group.

This guide does not repeat the general MFA rollout method, which we cover in rolling out MFA in an SMB. It explains what AuthPoint does, how it connects to each type of access, and the settings that make the difference. Every capability quoted comes from documentation published by WatchGuard. We work as a WatchGuard partner in Morocco, from Casablanca.

What AuthPoint includes

AuthPoint is built on three components.

• The AuthPoint mobile app, for iOS and Android. It receives push notifications, displays one-time passwords, reads QR codes and holds passkeys. Tokens can be protected with a PIN or the phone’s biometrics. The Device DNA feature binds each authentication to the phone actually enrolled: according to WatchGuard, a cloned phone is rejected.
• The AuthPoint console in WatchGuard Cloud, where you create users and groups, declare the resources to protect and write the policies. The console is multi-tenant, which lets a provider like us manage several companies separately.
• Components to install only when needed: the AuthPoint Gateway, the Logon app agent for computers and servers, and the agent for ADFS.

Licences are subscriptions; the licence key sets the number of users who can use MFA. A user without MFA does not consume a licence, but cannot sign in to resources that require it. WatchGuard offers two editions: AuthPoint MFA and AuthPoint Total Identity Security, the latter adding monitoring of credentials exposed on the dark web, among other things.

Authentication methods

Method	How it works	When to favour it
Push notification	The user approves the request on their phone	Daily use, VPN, Microsoft 365
QR code	The user scans a code shown on screen	Logon, including offline
One-time password (OTP)	A temporary code shown in the app	Fallback, phone without mobile data
Passkey	Fingerprint or face approval, passwordless	Exposed accounts, phishing resistance
Hardware token	A small device that displays a code	Staff without a usable work or personal phone

WatchGuard presents passkeys (FIDO2) as the phishing-resistant method. Push notifications remain the most convenient, but they are exposed to “push bombing”: an attacker who knows the password sends notification after notification until the user accepts out of fatigue. Hence the importance of training, described in the phishing scams targeting SMBs, and of well-written policies.

The resources AuthPoint protects

In AuthPoint, each access to protect is a “resource”. The resource type determines how it connects.

Resource	What it protects	Component required
Firebox	Firebox Mobile VPN (IKEv2, SSL…), authentication portal	Firebox connected to WatchGuard Cloud
RADIUS client	Firewalls, VPNs and third-party devices that speak RADIUS	AuthPoint Gateway
SAML	Web applications: Microsoft 365, Salesforce, Firebox Access Portal…	None, except for users synced from an on-premises directory
Logon app	Windows and macOS logon, RDP, RD Gateway	Agent installed on the computer or server
ADFS	Applications federated through ADFS	Agent for ADFS and AuthPoint Gateway
Microsoft external MFA	Microsoft Entra ID sign-ins, hence Microsoft 365 and Azure	Entra ID P1 licence or higher

The AuthPoint Gateway is a lightweight application installed on your network. It acts as the RADIUS server for your devices and talks to an Active Directory or LDAP directory. A primary Gateway can be backed by secondary Gateways for failover, without load balancing.

The Firebox VPN: the first project

Remote access is the most attacked door, and that is where we switch on AuthPoint first. There are two set-ups.

• The direct set-up: the Firebox is registered in WatchGuard Cloud, you declare a Firebox resource in AuthPoint, then select AuthPoint as the authentication server in the Mobile VPN configuration. It is the simplest, and it works with users created in AuthPoint as well as directory users.
• The RADIUS set-up: the Firebox queries the AuthPoint Gateway, with a Windows NPS server when users come from Active Directory. This is the route for older Fireware versions or Fireboxes not connected to the cloud.

Two technical details save a lot of tickets. With Mobile VPN with IKEv2 and Active Directory accounts, authentication goes through MS-CHAPv2, and WatchGuard states that entering an OTP is not supported in that case: users approve by push. AuthPoint’s authentication timeout is 60 seconds and cannot be changed; the VPN timeout must not exceed it. Choosing the VPN type is the subject of our guide WatchGuard VPN: Mobile VPN IKEv2, SSL and remote work.

Microsoft 365: Entra ID external MFA

Microsoft has made external MFA generally available in Entra ID, and WatchGuard announced AuthPoint support from April 2026. The principle: in WatchGuard Cloud, you create a Microsoft external MFA resource with the Entra application ID; in the Entra admin centre, you add AuthPoint as an external authentication method, then a Conditional Access policy enforces it for everyone or for specific groups.

What to know before you start:

• The Entra ID P1 licence (or higher) is a Microsoft requirement. It is part of Microsoft 365 Business Premium; with Business Basic or Standard, it must be added. We compare these plans in Microsoft 365 Business Basic, Standard or Premium.
• It is not mandatory. For a company that only uses Microsoft 365, Microsoft Authenticator is often enough. AuthPoint becomes worthwhile when you want the same app for the VPN, endpoints and Microsoft 365, with a single console.
• MFA does not replace the tenant’s other settings, such as blocking legacy authentication, covered in secure Microsoft 365: the 10 settings.

Computers and servers: the Logon app

The Logon app adds a second factor to Windows and macOS logon, to remote desktop (RDP) and to RD Gateway. It consists of an agent installed on the machine and a resource declared in AuthPoint. It is the only resource that supports offline authentication: WatchGuard recommends allowing QR code or OTP so that users can open their session without internet access.

We deploy it first on servers reachable over RDP, administrators’ computers and laptops that leave the office. An RDP server protected by a password alone remains one of the main entry points for ransomware, as we point out in ransomware: 7 measures for an SMB.

Users: local or synced

Three user sources coexist:

• AuthPoint users created in the console, with an activation e-mail.
• Users synced from Active Directory or LDAP through the Gateway, group by group or with advanced queries. They keep their Active Directory password, and sync runs on a schedule.
• Users synced from Microsoft Entra ID, for companies without an on-premises directory.

Our rule: one source of truth. Users are created and disabled in the directory, never by hand in two places.

Zero Trust policies: where security happens

An AuthPoint policy ties together groups, resources and allowed methods. You can add conditions:

• Network location: a list of IP addresses from which the policy applies.
• Time schedule: the days and times when the policy applies.
• Geofence: a list of countries, for example to block sign-ins from countries unrelated to your business.
• Geokinetics: automatic denial when a user signs in from a place they could not physically have reached since their previous sign-in.

The classic trap: a policy with conditions denies access to anything outside those conditions. WatchGuard therefore recommends creating a second policy, for the same groups and resources, without conditions, then setting the order of precedence. Another documented limit: RADIUS resources support neither network location nor geofence, because AuthPoint cannot see the user’s IP address.

The mistakes we fix

1. AuthPoint bought, never deployed on the VPN: the licence exists, the VPN still accepts a password alone.
2. The VPN protected, but not RDP: a server stays open without a second factor.
3. An overly strict policy with no fallback policy, locking out travelling sales staff.
4. Accounts created by hand alongside the directory, never disabled when staff leave.
5. Administrators exempted “to save time”, although theirs are the most targeted accounts.
6. No plan for a lost phone: no reset procedure, no backup token.

Checklist before deploying AuthPoint

• List of accesses to protect: VPN, RDP, logon, Microsoft 365, web applications.
• User source chosen: Active Directory, Entra ID or the AuthPoint console.
• Gateway planned if RADIUS, on-premises Active Directory or ADFS is involved.
• Entra ID P1 licence checked for Microsoft 365 external MFA.
• Allowed methods per population, hardware tokens for exceptions.
• Zero Trust policies with an unconditional fallback policy.
• Documented procedure for a lost or replaced phone.
• Communication to users before each wave.

How we do it

We start with a free initial audit of your access: who signs in to what, from where, with which accounts. We then configure AuthPoint in WatchGuard Cloud, connect the directory, and enable MFA in waves: administrators and VPN first, remote desktop and servers next, Microsoft 365 and endpoints last. Each wave comes with a note to users and help with first enrolment. Once in production, sign-in alerts and WatchGuard devices are monitored 24/7, and a critical incident is handled in under 15 minutes.

AuthPoint is part of our business cybersecurity in Morocco offering, alongside the WatchGuard Firebox firewall and the endpoint protection covered in WatchGuard EPDR and Endpoint Security. For the bigger picture, read Zero Trust for an SMB. Request your free initial audit: we reply within 24 business hours.