Configuring Universal Print Integration

Universal Print Integration Overview

Universal Print is a Microsoft 365 cloud-based print infrastructure that simplifies office printing for IT administrators and employees. Universal Print eliminates on-premises print servers and does not require print drivers.

If your organization is using Microsoft 365 in an Azure AD environment, Universal Print provides an easy way to manage printers via group policy. Pharos Secure Release provides several extra capabilities on top of Universal Print:

  • Provides secure printing, including end-to-end encryption. Users need to authenticate at a printer to collect their documents. Only users who submitted the document can release them.
  • Installs a single queue that users can print to and then release anywhere.
  • Supports proximity cards, email authentication, and mobile app release (for Pharos Secure Release jobs).
  • Supports internet-only environments (sometimes referred to as zero-trust networks).
  • Identity management and federated authentication.
  • Support for mixed device environments. The integration supports printers from multiple manufacturers and their various device models.

How the Universal Print Integration Works

The following workflow assumes that you have both Pharos Secure Release and Universal Print configured.

  1. IT admin enables Universal Print integration on the web portal. Enabling the integration creates a single global queue (called Secure Printer) in Universal Print and creates a printer share for this queue.
  2. Users add the created Universal Print queue (Secure Printer) on their workstations.
  3. Users print to the Universal Print queue or the Secure Release queue from their workstations. Users can also print from mobile devices into Pharos Cloud. Universal Print documents are sent to Microsoft 365 storage or and Secure Release jobs are sent to Pharos Cloud.
  4. Users walk up to any printer to authenticate. Secure Release pulls all the print jobs held by Universal Print and all print jobs held by Secure Release. The user’s job list from both sources is presented on the device panel for print release.

Prerequisites

  • The organization has a Pharos Cloud account.
  • Users and IT administrators have a Universal Print license.
  • An administrator must be assigned a Printer Administrator or a Global Administrator role in the Azure Active Directory.
  • Users’ workstations require Windows 10 version 1903 or later.

Pre-Configuration for Universal Print Integration

Note: To configure and manage Universal Print integration, you must be assigned a Printer Administrator or a Global Administrator role in the Azure Active Directory.

The following shows steps to request access to the Pharos Cloud Universal Print Connector application in Azure. This application requires admin consent.

1. The printer admin navigates to the Secure > Universal Print tab in the web portal.

2. If not already logged in, the printer admin signs in with their Azure AD account.

3. If the Approval required message appears, enter a justification for requesting the Pharos Cloud Universal Print Connector. Click Request Approval.

4. The Azure administrator (or any administrator selected as a reviewer) is notified of the request with a link to the Azure portal to review the request in more detail.

Granting Admin Consent

The following steps show how the Azure administrator grants tenant-wide admin consent. Once the Azure admin grants admin consent, permissions to allow the Pharos Cloud Universal Print Connector to release users' print jobs are automatically enabled.

1. The Azure admin signs in to the Azure portal.

2. Select Azure Active Directory then Enterprise applications.

3. In the Admin consent requests, review and approve the consent request for Pharos Beacon Universal Print Connector. Select Review permissions and consent. The printer administrator (who sent the admin consent request) receives an email notification that their request is approved.

4. From the navigation menu, select Enterprise Applications.

5. Under Manage > All applications, search for Pharos Beacon Universal Print Connector and then select the application.

6. Select Permissions and then click Grant admin consent {Azure/Company name} to grant Pharos Beacon Universal Print Connector with some application-level permissions.

7. Once the Azure admin grants admin consent, the permission for the application changes from Delegated to Application with the following permissions automatically enabled.

  • Microsoft Graph
    • Printer.Read.All
    • PrintJob.Read.All
  • Universal Print
    • PrinterProperties.ReadWrite
    • Printers.Read
    • PrintJob.ReadWriteBasic

8. Once the above steps are complete, both the Printer Admin and the Azure Admin must repeat the steps mentioned in Pre-Configuration for Universal Print Integration.

Note: Because of the permission updates, we recommend the Printer Admin to sign-out from the existing Azure session, close the browser and repeat the steps on a newly opened browser.

Enabling Document Conversion

To support submitting print jobs to the Secure queue within Universal Print, the Printer Admin needs to enable the Universal Print setting called Document Conversion.

Enabling Universal Print Integration

1. Once all permissions are added, you can enable Universal Print Integration by toggling the switch for the "Enable Universal Print Integration" setting to ON.

Enabling the Universal Print integration does the following:

  • Creates a global single queue called Secure Printer within Universal Print.
  • Shares the Secure Printer (create a printer share) for users in your organization. All users print to that single shared queue.

2. Depending on your printer manufacturer and whether you want Cloud Release, you will need to do perform one of the following:

  • Enter a Document Proxy URL

  • Install a Universal Print compatible Print Scout.

Specify a Document Proxy URL 

The document proxy is responsible for retrieving documents from Universal Print and forwarding them to HP printers.

Note: Specifying a Document Proxy URL is suitable for sites with Hewlett Packard (HP) printers using Cloud Release only. For other printer manufacturers or for sites with HP printers who do not prefer to use Cloud Release, install a Universal Print compatible Print Scout instead.

Note: You will need to deploy the Universal Print Document proxy to your Azure environment first before you can specify a Document Proxy URL. For information on how to deploy the Universal Print Document Proxy to Azure, refer to the Deploying the Universal Print Document Proxy to Azure document.

After you have deployed the Universal Print Document Proxy to Azure, you can enter the Document proxy url in the Document Proxy section of the Universal Print tab.

Install a Universal Print compatible Print Scout

Installing a Universal Print-compatible Print Scout is suitable for the following scenarios:

  • Sites with printers that do not support Cloud Release, which includes all printer manufacturers except HP (only HP printers support Cloud Release).

  • Sites with HP printers who prefer not to use Cloud Release.

In the above scenarios, the Print Scout pulls the jobs directly from Universal Print and forwards those jobs to the printer.

Note: For more information on Universal Print compatible Print Scout, refer to the Installing a Universal Print compatible Print Scout document.

Adding the secure queue to users’ workstations

After the secure queue is created and shared within Universal Print, users can add the queue to their workstations.

1. Log in to Windows 10 using your AD credentials.

2. Go to Settings and find Printers and Scanners.

3. Select Add a printer or scanner.

4. Select Secure Printer and click Add device. Adding the device may take a few seconds.

5. After you’ve added the device, you will notice that the printer will be in Ready state.

Test Printing

1. Print as you normally would. Open an application and print to the newly added Universal Print Secure Printer.

2. Walk up to any Secure Release enabled printer and authenticate.

Universal Print Printing Preferences Dialog

This section describes the printing preferences available for the Universal Print queue.

The Universal Print Queue Printing Preferences includes two tabs: Layout and Paper Quality.

  • Layout - Describes how documents are shown

    • Orientation - Portrait or Landscape

    • Print on both sides - Flip on Long Edge, None, Flip in Short Edge

    • Page Order - Front to Back, Back to Front.

  • Paper Quality

    • Tray Selection - Paper Source - allows users to select a specific paper tray from which their document will be printed.

    • Quality Settings - Better, Draft, Best

    • Color -

Printer Features under the Advanced button

  • Output Bin: Users can now choose their preferred output tray for printing.

  • Stapling: Users can now choose their preferred stapling option:

    •  

  • None (default)

  • Top left

  • Top right

  • Bottom left

  • Bottom right

  • Left edge (2 staples)

  • Top edge (2 staples)

  • Right edge (2 staples)

  • Bottom edge (2 staples)

  • Saddle stitching

• Document Binding

o None (default)

o Bind (auto)

o Left edge (stitching)

o Top edge (stitching))

o Right edge (stitching)

o Bottom edge (stitching)

• Hole Punching

o None (default)

o Hole punch (auto)

Note: If users do not explicitly select paper source and output tray options, the system will default to either a standard configuration or the printer’s default settings.

 

 

 

 

 

Disabling the Universal Print Integration

Before disabling Universal Print integration, consider the effects on your print environment and users.

Disabling the Universal Print Integration will:

  • Remove all print jobs in the Universal Print queue.
  • Remove the Secure Printer queue from Universal Print.
  • Disconnect your system from Universal Print.

Note: Disabling the Universal Print integration does not remove the Secure Printer queue installed on users' workstations.

To disable Universal Print Integration:

1. Navigate to the Secure > Universal Print tab of the web portal.

2. Toggle the Enable Universal Print Integration switch to OFF.

3. You’ll see a warning before you can proceed. Enter your Site Encryption Key as requested and click Confirm.

4. A progress bar showing the disconnecting process is shown. This may take a few minutes to complete.

5. Go to your Azure portal and check that the printer is no longer in the Printers list.

Universal Print Integration Limitations and Known Issues

  • Reprinting jobs (Retain After Printing option on the printer) is not supported for jobs submitted via Universal Print.
  • Universal Print jobs are not yet reported.
  • While Secure Release jobs can be released using the mobile app and SR25, these release options are not yet supported for Universal Print jobs.
  • The Pharos Print desktop app does not list Universal Print jobs. An incorrect number of pages displayed at the printer prior to release. For example, if you have printed 4 pages, it may show 0 pages.
  • The option to Print All documents may fail with default settings. The workaround is to request the Operations team to increase the Default Network Timeout to 3000 on your iMFP settings.
  • If you have Cloud Release enabled and you have not set up a Document Proxy URL, you may encounter the Error Releasing Print Jobs error at the printer. Make sure to set up a Document Proxy URL if you have Cloud Release enabled.

Related Topics: