Papercut & InTune

[garethEds]

HI All,

 

We are considering the move to InTune this year (LEA/Hwb Cymru push maybe) but the PaperCut server is a red line that is stopping us move now. We have an on-site PaperCut server. We are not part of the LEA print SLA and went alone for reasons that are not important here.

 

How do people that have migrated to InTune make use of their on-site PaperCut server (if they have one) - is it possible? Or are we better asking PaperCut to host the server in the cloud as well?

 

I'm not sure Hwb will let us have our own and we may be expected to revert to the LEA centrally hosted print server.

 

Looking forward to responses.

[psynegy]

We have this working for the most part. We're a hybrid environment at present.

 

AD joined PaperCut server, we use a win32 package of Print Deploy (now called Enable Printing for some reason) to deploy our "global queues". Separate package to install the printer drivers.

 

Takes a moment or two when they first log in for the printers to install, but that seems to be the best way at the moment.

 

Big change was to switch over PaperCut to sync exclusively with Entra ID, rename all the accounts to email addresses, but add username aliases for AD printing.

 

Was able to get PaperCut to sync our RFID cards from a "custom security attribute" in Entra. This is important, because PaperCut suggest using the extension attributes, but those are readable by all users in Entra!!

 

If you have students/staff logging in to copiers using username/password - there's a bit of a gotcha with Conditional Access, as Microsoft changed something recently that means you can't just exclude an app from MFA being required (because most things that do auth also use the graph app), so you have to revert the behaviour for that app using the Baseline Scope Settings.

 

I think there shouldn't be too much issue moving the PaperCut installation to an Arc'd server - the biggest hurdle there seems to be getting group based permissions to work. I believe there are some workaroun.... "clearly documented and easy to understand solutions" though.

[RobFuller]

@psynegy Can I ask which manufacturer and MFD models you are currently using?

 

Ricoh have advised that if we move to SAML 2.0 authentication, username and password sign-in via the embedded application will no longer be supported. RFID authentication will continue to work as normal.

 

I’d be interested to know whether you have encountered this limitation and, if so, how you have addressed it.

[6Foot3]

Just save yourself the hassle and use Printix.net

[RobFuller]

7 minutes ago, 6Foot3 said:

Just save yourself the hassle and use Printix.net

 
Over PC Hive?

[Synkrox]

We have on prem papercut picking up jobs from a MS Universal Printer that is pushed to intuned devices. papercut on MFDs runs as normal and talks to our on prem papercut as normal.

 

The only caveat is if you want different finishing - stapling for example - you need to create individual printers for this as universal print has almost no options to set.
 

You get quite a chunk of universal print usage thrown in with edu license so we don't buy anything on top.

[psydii]

15 minutes ago, Synkrox said:

The only caveat is if you want different finishing - stapling for example - you need to create individual printers for this as universal print has almost no options to set.

1996 is calling with a prior art claim.  This is how I saw it done when the printers were connected to VMS, the clients were Windows 3.11 / 95 and the domain was NT 3.51.

[psynegy]

On 11/09/2026 at 14:51, RobFuller said:

@psynegy Can I ask which manufacturer and MFD models you are currently using?

 

Ricoh have advised that if we move to SAML 2.0 authentication, username and password sign-in via the embedded application will no longer be supported. RFID authentication will continue to work as normal.

 

I’d be interested to know whether you have encountered this limitation and, if so, how you have addressed it.

 

I'm not 100% sure if that is the same issue we were able to work around or not. We have Toshiba MFDs.

 

Certainly initially, staff logins didn't work, but only because they require MFA if not from a managed/compliant device.

 

What we did during some downtime was checkpointed the papercut VM, then essentially went through the process of doing the migration, made sure it all worked before then either committing to the change, or being able to easily roll it back if we need to figure something else out.

[6Foot3]

On 11/09/2026 at 15:01, RobFuller said:

 
Over PC Hive?

 

I have not used Hive, but I've only heard bad things about it. Maybe it has gotten better over the last two years.

 

My Schools have been using Printix for the last two years, and we've only had one outage that lasted 2 hours. It's super easy to set up, and pricing is based on staff count; students are free.

 

It doesn't matter how many MFs, etc you have. 

The free trial is really good also, so you can do a full test of the system in your environment, and it doesn't cost anything.

 

We use follow me printing and have Paxton cards set up for authentication.

[Roberto]

26 minutes ago, 6Foot3 said:

My Schools have been using Printix for the last two years, and we've only had one outage that lasted 2 hours. It's super easy to set up, and pricing is based on staff count; students are free.

My (non edu, global) employer has been using this to support thousands of people printing across literally hundreds of offices and we've had little to no hassle. I'm not sure I entirely _like_ it, but it gets the job done and done well. Printix is well worth a look. And I used to love papercut, so this is something of a comparison call on my part, not an isolated judgement.

[itskdog]

We use Riso MFDs here so Hive isn't suitable as they only have the Lite version in the firmware, so still have an on-site MF server.

 

Configured Entra as our sync source, set up SAML for web authentication (found that was quicker than using OAuth).

 

We're using Print Deploy + Mobility Print to authenticate to the printers, users just need to click "Sign in with Microsoft" once upon logging in to a PC for the first time to authenticate (doesn't support automatic Entra auth like CDM or OneDrive, unfortunately).

 

Pushed out Print Deploy and User Client as Win32 apps, PaperCut have documentation in the manual on how to do that. (User client needs manually updating with every server update)

 

Also make sure to change the config key to make the User Client check the UPN rather than the username, see this post for details: 

 

[Edu-IT]

On 11/09/2026 at 15:01, RobFuller said:

 
Over PC Hive?

I've heard comments that people who have used both preferred Printix. 

[Mr.Ben]

I prefer Printix for just printing, but it is still quite limited on copier support for other functions.

 

We have just rolled out hive for staff (which is brilliant), but the experience for Students needs work.

 

Both systems have issues with iPads, but having use both Papercut hive is the easier to manage.

 

 

 

[RobFuller]

Lack of shared accounts in Printix is a show stopper for us 🫤