Office Networks
Part of Small business printers and scanning
Setting up secure shared printing with Universal Print
A shared printer is a small information system.
Shared printers can expose payroll, customer records and contracts through abandoned pages or misdirected jobs. Set access before sharing, hold sensitive jobs for collection, and rehearse what staff should do during an outage or device replacement.
Define access and release
In Microsoft Universal Print, share the printer only with groups that need it; do not grant every account access by default. Users need an eligible Universal Print licence to print.
Check existing Windows and Microsoft 365 licences. If needed, purchase eligible licences through your regular channel, then assign them to users and IT admins who need access. Assign applicable administrator roles to people who manage Universal Print.
Before deployment, confirm Windows 1903 or later or macOS Ventura 13.3 or later; Windows Server is not supported. All endpoints, including users’ devices and printers, must be able to reach Universal Print services.
For the commercial environment, allow access to print.print.microsoft.com, register.print.microsoft.com, discovery.print.microsoft.com, notification.print.microsoft.com, graph.print.microsoft.com and login.microsoftonline.com. Apply this to both users’ devices and printers.
Secure release holds jobs until a user manually releases them. Direct printing sends jobs as soon as they are submitted unless a third-party release system is configured. Use secure release where an unattended tray could expose confidential pages.
To enable QR release, a user with Printer Administrator role access rights opens Universal Print in the Azure portal, goes to Printer Shares, selects the share, then opens Properties > Job release settings. Turn on “Enable holding jobs until secure release”, save, then save the QR code, print it and attach it to the printer.
Use “View printer job release methods here” to check which methods the selected printer supports. With QR release, users scan the printer’s code and release jobs in the browser-based Universal Print portal; the Microsoft 365 Copilot app is not required.
Each QR-release user needs a Universal Print licence, a camera, and a device and browser profile that meet the organisation’s sign-in requirements, including Conditional Access policies. A personal phone or arbitrary browser might not be allowed, so test the device and browser combinations staff will use.
For Xerox B305 and B315 printers, Windows 11 supports PIN-protected printing; the stated example is a 4-digit PIN using 0–9. Treat this as a device-specific option and confirm the release method supported by the printer before rollout.
Test with an ordinary employee, a former employee account and an unauthorised account. Check who can see the queue, submit jobs, view job names and collect pages. Decide when abandoned jobs should expire and verify how the queue applies that rule.
Pre-deployment checklist for secure shared printing with Universal Print
- Verify eligible licencesConfirm users and IT admins have Microsoft Universal Print licence via Microsoft 365 or Windows 1903+ / macOS Ventura 13.3+
- Assign rolesGrant Printer Administrator role to IT staff managing Universal Print
- Configure network accessAllow traffic to print.print.microsoft.com, register.print.microsoft.com, discovery.print.microsoft.com, notification.print.microsoft.com, graph.print.microsoft.com, login.microsoftonline.com
- Enable secure releaseTurn on 'Hold jobs until secure release' in Azure portal under Printer Shares > Properties > Job release settings
- Generate and attach QR codePrint QR code from Azure portal and place near printer; ensure it's visible and accessible
- Test device compatibilityVerify user devices meet sign-in requirements including Conditional Access policies and have camera access
Key security metrics for shared printing in Australia
- 1903Minimum OS requirement
- 365Licence required
Maintain the device
Secure release holds jobs until the user releases them. Direct printing sends jobs on submission unless a third-party release system is configured. Simulate an outage and check whether pending jobs remain queued, can be released after reconnection or must be resubmitted.
Define an urgent fallback route and keep it to the same confidentiality standard. Tell staff what to do if the secure queue fails, rather than leaving them to choose an unapproved printer or collection method.
For a Xerox B305 or B315, register through Settings > Network/Ports > Universal Print > Register; complete code validation within 15 minutes because the registration code expires then. The Universal Print page can deregister a device.
When replacing a Xerox printer, deregister the old device and register its replacement. If QR release is enabled, remove the old code, attach the replacement printer’s QR code and test access and release before staff use it.
Change default administrative credentials, restrict management access and apply supported firmware updates. Decide who handles stored jobs and device data when the printer is disposed of.
Place a confidential-waste bin near the printer for misprints, and remind staff not to leave pages on the tray. Review access after role changes and check that staff can collect their own jobs without exposing someone else’s.
