Reviewed and updated in October 2026.
Security is a delicate combination of technology and processes, and it ultimately relies on end users acting in line with the defined standards and practices. Authenticating those users is the first step.
What is Hypergate Authenticator? Hypergate Authenticator is a managed app for Android Enterprise and iOS that gives mobile devices Kerberos single sign-on against an existing Active Directory. It talks directly to the domain controllers, so no new servers or middleware are needed, and users reach intranet sites and internal apps without typing their password again.
In the past, authentication was relatively easy to manage: users connected to the company network mostly from the same computer, and occasionally from a laptop at an external location.
In the modern workplace, mobile devices are everywhere, whether they are personally owned (BYOD) or corporate-owned and personally enabled (COPE). Users connect to company resources from several devices and many apps, and keeping passwords in sync across all of them is a challenge.
Security rules have also made the once simple password overly complex: combinations of letters, numbers and symbols that are hard to remember, and in many organizations a forced change every few months. That pushes people toward weak, easy-to-guess passwords or the same password for every account, which puts security at risk. Current guidance agrees: NIST's SP 800-63B says verifiers shall not require users to change passwords periodically, but shall force a change when there is evidence that a password has been compromised.
This is where we recommend single sign-on (SSO), which helps users overcome the password problem without weakening security. For mobile devices in an Active Directory environment, Hypergate Authenticator is a strong candidate. If you want the background on simpler security first, read Security Through Simplicity, the article this one originally followed.
Hypergate Authenticator brings native Kerberos authentication to Android devices and also supports iOS. It requests tickets directly from the Kerberos Key Distribution Center on your domain controllers, the same way domain-joined Windows clients do. That has several practical consequences:
The companion app Hypergate Files uses the same Kerberos sign-in to give Android and iOS devices access to on-premises SMB2 and SMB3 shares, including NetApp backends. Files open in their native apps such as Word, Excel or a PDF viewer, without a special viewer.
Microsoft has announced that it will disable NTLM by default in future Windows releases. Mobile devices that still reach intranet sites, internal web apps or file shares via NTLM need a Kerberos path. We explain the background and a migration plan in Replacing Acronis Cyber Files and leaving NTLM: Kerberos SSO for Android without the cloud.
Hypergate, a Swiss vendor (Papers AG), makes the apps. ISEC7 is a Hypergate partner for Germany, the United Kingdom and the United States and takes care of integration and rollout, and of operation if you want it. SSO is one part of a broader access strategy; see also Demystifying Security: Multi-Factor Authentication and Demystifying Security: Zero Trust.
No. Hypergate Authenticator connects directly to your existing domain controllers using Kerberos. There is no gateway, proxy or cloud service in between, which is why it also works in air-gapped networks.
Android Enterprise devices from Android 7.0 onward, and iOS. The app is distributed and configured through your UEM; Microsoft Intune, Ivanti, Omnissa Workspace ONE UEM, BlackBerry UEM, SOTI and 42Gears are supported.
The app obtains its Kerberos ticket directly from the domain controller, either with a user certificate delivered through the UEM or with username and password. No NTLM hashes are created that could be captured and reused, and the mobile sign-in appears in the domain controller log as a Kerberos ticket request.
Yes. When a password expires, users change it directly on the device, without having to go to a Windows computer.
Planning SSO for your mobile fleet or a move away from NTLM? Our page on Acronis Cyber Files and NTLM summarizes the options, our team supports endpoint management projects end to end, and our Android trainings prepare your administrators. Contact us with any questions.