# PaperCut deployment for Entra-only devices

Understand the recorded shift from local-domain printer deployment to Entra user synchronisation, Microsoft authentication and the PaperCut Print Deploy client.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

## Preface {#source-b191bd787009be07}

With the move to Azure AD Cloud Only users and devices, the configuration of Papercut, which is still an on premise service, changes significantly.

- The location for synchronising user accounts moves from on premise to Azure AD
- Authentication happens in Azure AD
- Usernames change from samAccountName to UPN.
- Print queue deployment moves from Group Policy to PaperCut Print Deploy Client.
- Users who were created in AzureAD and have no on premise samAccountName originally will get a local device logon name of FirstNameLastName. This breaks the Print Deploy client.

The following documents the integration of Papercut with Azure AD, synchronisation of user accounts, Authentication settings and Papercut Print Deploy Client configuration.

## Preface {#source-3642b3b61c628aeb}

Prior to Azure AD printers were normally installed as server based print queues deployed to clients. This worked as users were authenticated on the print server via NTLM on the local domain.

With Azure AD Only computers and users, print server queues no longer work as the users don't exist in the local domain and therefore can't authenticate against print server queues directly.

It is therefore necessary to use the PaperCut Print Deploy Client to deploy print queues to clients. This offloads the authentication from NTLM to PaperCut Azure AD SSO integrated authentication.

For instructions on setting up PaperCut Azure AD integration and Print Deploy Client configuration see this section [PaperCut Azure AD Integration](../../review/Review-status.md#link-1640f3fa608b)

There are 2 options for enabling printing for Azure AD Only computers and users in Print Deploy.

- Direct Print Queues — the source reports reliability and setup difficulties and recommends against this approach for the described environment.
- Mobility Print Queues - This essentially enables server based queues that are authenticated via Azure on the Mobility print server, and deployed via print deploy.

This document only describes Mobility Print Queue setup.

The following instructions assume PaperCut MF is installed and configured for Azure AD Integration, with printers setup, and assumes Mobility Print is installed.

The high level steps are:

- Publish PaperCut Printers in Mobility Print
- Install Mobility Print Queues on a Reference Computer
- Configure Mobility Print Queues on the Reference Computer
- Clone the Mobility Print Queues to PaperCut MF

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)