AAA as a Service: Is Managed AAA Right for Your Network?

AAA as a service – often searched as RADIUS as a service – means a vendor runs your authentication, authorization, and accounting platform: upgrades, patching, monitoring, and the on-call rotation. For ISPs and small CSPs where AAA expertise sits with one or two engineers, the managed model usually buys more reliability than another server would. You gain an SLA and lose some direct control, so the decision comes down to security, compliance, customization, and cost shape.

Every operator has a version of this system: the AAA server that has run for years and that everything depends on. Exactly one person on the team fully understands it. It authenticates every broadband session and feeds every accounting record into billing. It gets touched as rarely as possible, because the last upgrade was tense.

That situation is why searches for RADIUS as a service keep climbing among smaller operators. The question behind the search is rarely about the protocol. It’s about whether a system this critical should be operated by a team that can only staff it part-time, or handed to a vendor whose engineers run AAA platforms all day.

This article works through that decision: what AAA as a service covers, how it differs from self-hosting, and where it helps smaller operators most. It also covers the security, compliance, and pricing questions to settle first.

What Is AAA as a Service?

AAA as a service, sometimes abbreviated (AAAaaS), is a delivery model where a vendor operates your authentication, authorization, and accounting platform on your behalf. That covers deployment, upgrades, patching, tuning, capacity, monitoring, and incident response. Your team consumes the service. Subscribers authenticate, sessions get accounted, and the day-to-day work happens on the vendor’s side of the line.

You will see the model marketed under several names. RADIUS as a service is the most common in the ISP world, because RADIUS carries broadband authentication (RFC 2865 still defines it, decades on). Managed AAA is the broader telecom term, since operator platforms typically speak Diameter and TACACS+ alongside RADIUS. The names point at the same idea: the platform becomes someone else’s job to run.

One distinction saves a lot of confusion in vendor conversations. Where the platform runs and who runs it are separate decisions. A managed AAA can run in the vendor’s cloud, in your private cloud, or on servers in your own data center with the vendor operating them remotely.

If your main constraint is hosting – latency budgets, data residency, cloud strategy – that’s a cloud RADIUS architecture question. This article is about the second axis: the operating model.

It’s also worth separating telecom-grade RADIUS as a service from the enterprise variety. A hosted 802.1X service that authenticates office laptops against a cloud directory is a real product, but it is not built for revenue-carrying subscriber authentication.

A telecom managed AAA has to handle BNG and BRAS session storms, the full EAP method family, and Diameter interfaces into the core. It also needs Change of Authorization (CoA) for live session control (RFC 5176) and the accounting stream your billing depends on. If a provider’s documentation never mentions those, it was built for the office Wi-Fi market.

Managed AAA vs Self-Hosted AAA

The honest comparison isn’t “managed versus self-hosted.” It’s “managed versus what your self-hosted operation actually looks like.” That includes the upgrade that keeps slipping and the single engineer who can’t take two weeks off in a row.

Dimension	Self-hosted AAA	Managed AAA (AAA as a service)
Operations	Your team owns upgrades, patching, tuning, and on-call	Vendor’s specialist team carries all of it under an SLA
Expertise	Concentrated in one or two engineers; a resignation is a risk event	Spread across a bench that runs AAA platforms for many operators
Upgrades	Scheduled when the team has capacity – often deferred	Performed routinely by people who did the same upgrade last week
Incident response	Depends on who is awake and what they know	24/7 coverage with escalation paths in the contract
Capacity planning	Sized by forecast; growth means a procurement cycle	Vendor’s responsibility to stay ahead of your growth
Control	Direct: change anything, anytime	Mediated: changes go through requests and change windows
Cost shape	CAPEX-weighted, plus the staffing cost that rarely gets counted	Subscription OPEX, predictable from year one

Two rows deserve expansion, because they decide most evaluations.

• The expertise row is the real product

AAA looks simple from a distance – requests come in, accepts go out. Up close it is EAP state machines, Diameter peering, attribute quirks across every BNG and WLC brand you own, and accounting checks that quietly protect your revenue.

A vendor team sees failure modes across its whole customer base; your team sees only yours. When an authentication storm follows a regional power restoration, that experience gap is measured in minutes of outage.

• The control row is the real cost

Under a managed model, you don’t SSH into the box and change a policy at 11 p.m.; you raise a change request. Good vendors make routine changes fast and offer self-service for the common ones.

Still, the workflow is an adjustment for teams used to owning everything. If your service depends on frequent, deep AAA policy experimentation, weigh this row heavily.

Benefits for Smaller Operators

The case for managed AAA is strongest for ISPs and small CSPs, for a structural reason: AAA workload doesn’t scale down as fast as headcount does. A platform serving a smaller subscriber base needs the same upgrades, patching, and 24/7 attention as one serving millions. A smaller operator can’t dedicate a team to it.

1. The bus-factor problem goes away. In many smaller operators, AAA knowledge lives with one engineer. Every vacation or resignation becomes a continuity risk for the system that authenticates every subscriber. A managed service replaces that single point of knowledge with a contractual obligation and a staffed bench.
2. Upgrades stop being events. Self-hosted AAA in small teams tends to freeze: the version that works stays, patches wait, and the eventual forced upgrade is a high-risk leap across several versions. Under managed AAA, upgrades happen on a routine cadence, performed by engineers who did the same version step last month.
3. Senior engineers return to revenue work. Hours spent babysitting AAA are hours not spent on the fiber build, the new wholesale product, or the network expansion. For a small CSP, redirecting even half an engineer’s time toward growth is often worth more than the managed service costs.
4. Carrier-grade availability becomes reachable. Engineering genuine high availability for AAA – active-active redundancy, externalized session state, tested failover – is a serious project. Most small operators run an active-standby pair and hope. A managed AAA built on carrier-grade architecture gives a smaller operator the availability engineering that Tier-1 deployments get, without building the discipline in-house.
5. Scaling is the vendor’s problem. Subscriber growth, a new EAP method for Wi-Fi offload, Diameter interfaces for a core upgrade – under a managed model these are service requests, not research projects for your team.

Considerations: Security, Compliance, Customization

None of the benefits matter if the model fails your security review. Three areas deserve real scrutiny before any contract.

Security: know exactly who can touch what. Your AAA platform holds subscriber credentials and maps IP addresses to subscribers – some of the most sensitive data an operator handles. Ask the vendor to show, not describe.

How is admin access to your instance controlled and logged? Is your data isolated, or shared multi-tenant? How are credentials encrypted at rest and in transit, and how fast do security patches reach production?

If AAA traffic crosses a network boundary to reach the managed platform, the transport needs the same rigor: RadSec (RFC 6614), IPsec, or private interconnect – chosen, not inherited.

Compliance: residency and lawful intercept don’t outsource. Regulatory duties stay with you, the license holder, no matter who operates the platform. If your regulator expects subscriber data to remain in-country, the managed deployment has to respect that. That may mean the vendor operating a platform inside your own facilities rather than in a shared environment abroad.

Lawful intercept and data retention rules often assume specific jurisdictions and response times; put them in the requirements document, not the follow-up questions. Start the legal review early, because it can rule out deployment options before the technical review begins.

Customization: find the edges before you sign. Managed platforms run efficiently because they run consistently, which means heavy customization cuts against the model. List your genuinely non-standard AAA behavior: exotic vendor-specific attributes, unusual policy logic, integrations into home-grown OSS.

Then ask which of those the managed service supports as configuration, which require change requests, and which it won’t do at all. A mismatch found during migration is expensive; the same mismatch found during evaluation is a Tuesday.

Add a fourth item reviews often skip: the exit. A managed AAA holds your subscriber profiles, policies, and accounting history. Before signing, know how you’d get them back: export formats, migration help the vendor must provide, and whether the platform could convert to a self-operated deployment.

Pricing Models for Managed AAA

Managed AAA is subscription-priced almost everywhere, but the structures vary, and the differences matter more than the headline number.

1. The cost shape changes before the amount does. Self-hosted AAA is CAPEX-weighted: hardware and licenses up front, a refresh cycle every few years, plus the staffing cost that business cases usually leave out. Managed AAA converts all of it into a predictable operating expense: no five-year hardware bet, no procurement spike, and a cost line finance can forecast.
2. Expect subscriber-based scaling. Most vendors price against active subscribers or devices, usually in tiers, so cost grows with the revenue base AAA supports. Beyond subscriber count, the drivers are usually protocol footprint (RADIUS-only versus full Diameter and TACACS+) and the redundancy topology you require. The support tier matters too: response-time SLAs, escalation paths, and how much day-to-day work the vendor carries.
3. Compare against your true self-hosted cost. That number includes hardware and licenses. It also includes the loaded cost of engineering time spent on upgrades, patching, monitoring, and on-call, plus some estimate of outage risk under the current staffing reality. Managed AAA often looks expensive against the hardware line alone and cheap against the honest total.

The answers to four questions separate a subscription from a subscription with surprises:

• What is included before change requests start billing separately?
• How are mid-term subscriber growth and new protocol needs priced?
• What do SLA remedies actually pay out when missed?
• Is migration work fixed-scope or open-ended?

Pricing depends on subscriber base, protocols, and deployment model, so useful numbers come from a scoped conversation rather than a rate card.

When AAA as a Service Is Right

The pattern across operators who choose managed AAA is consistent. The model fits when several of these are true:

• AAA expertise is thin or concentrated. One engineer understands the platform, or the person who built it has left, or the team dreads every upgrade. This is the single strongest signal.
• You’re carrying an end-of-life platform. Operators on unsupported software – Cisco CPAR is the common case – face a forced migration anyway. Moving to a platform someone else operates solves the immediate problem and the recurring one in the same project.
• Growth is outrunning operations. Subscriber additions, a new fiber footprint, or an acquisition is stretching a team already at capacity.
• Engineering time is worth more elsewhere. The build-out backlog is long and the AAA babysitting hours have better uses.
• You need availability you can’t staff. Genuine 24/7 coverage requires an on-call rotation a three-person network team can’t sustainably run.

Self-hosting keeps the advantage in the opposite cases: a staffed AAA team with real depth, custom policy logic that changes frequently, or a regulatory posture that rules out external operational access. Even then, vendor-operated deployments inside your own facilities are worth a look before ruling the model out.

Alepo Managed AAA Service

Alepo offers its carrier-grade AAA platform as a fully managed service. Alepo’s engineers run the platform – people, process, and platform operations – while your team consumes AAA as a service with contractual SLAs.

The platform underneath is the same one Alepo deploys for Tier-1 operators. It is engineered for 99.999% availability with active-active geo-redundancy, 36,000+ transactions per second of headroom for re-authentication storms, and sub-millisecond authentication decisions. It terminates RADIUS, Diameter, and TACACS+ on a single stack and supports the full EAP method family, from EAP-SIM and EAP-AKA’ through EAP-TLS.

It integrates with the BNG, BRAS, and Wi-Fi equipment operators actually run: Cisco, Nokia, Juniper, Aruba, Ruckus, and others. An AI Agent Assist layer decodes reject codes and EAP failure traces in plain language and surfaces probable root cause, shortening diagnosis for the incidents that do occur.

Deployment follows your constraints: Alepo can operate the platform in the cloud, in your private cloud, or on-premises in your facilities where data residency demands it. Support runs through Alepo’s engineer-staffed Global Technical Assistance Center, with tiered SLAs and named Technical Account Manager options.

Behind the service is 20+ years of carrier AAA engineering and 35+ global deployments for operators globally. Much of that record is structured migrations off end-of-life platforms such as Cisco CPAR – exactly the starting point for many operators evaluating managed AAA today.

Book a demo and see what it looks like when Alepo’s specialists carry the upgrades, the patching, and the on-call – and your team just consumes the service.

Frequently Asked Questions

Q1. What is AAA as a service?

AAA as a service (AAAaaS) is a delivery model where a vendor operates your authentication, authorization, and accounting platform under an SLA: upgrades, patching, monitoring, capacity, and incident response. Your subscribers authenticate against it as usual. It changes who runs the platform, not what the platform does.

Q2. Is RADIUS as a service the same thing as managed AAA?

Nearly. RADIUS as a service is the common term in the ISP market, where RADIUS carries broadband authentication. Managed AAA is the broader telecom term, covering platforms that also speak Diameter and TACACS+. In a RADIUS as a service telecom evaluation, the two labels usually describe the same offering. What matters is whether the service is built for carrier workloads rather than enterprise Wi-Fi.

Q3. How is managed AAA priced?

As a subscription, typically scaling with active subscribers or devices, adjusted for protocol footprint, redundancy requirements, and support tier. It converts the CAPEX-plus-staffing cost of self-hosting into predictable OPEX. Compare it against your true self-hosted cost, including engineering time and outage risk, not the hardware line alone.

Q4. Is managed AAA secure enough for a telecom operator?

It can be, with the right controls: audited administrative access, tenant isolation, encryption in transit and at rest, and disciplined patching. Where AAA traffic crosses network boundaries, add a secured transport such as RadSec or IPsec. Data residency and lawful intercept duties remain yours, so verify the deployment model satisfies your regulator – including on-premises managed options where required.

Q5. Can we move back to self-hosted later?

A well-structured contract makes this possible: data export in usable formats, documented policies, and migration help written into the contract. Ask the exit question during evaluation, before any commitment. How readily a vendor answers tells you a great deal.