Enabling Entra ID (Azure AD) for PaperCut NG/MF version 21.1 or earlier
THE PAGE APPLIES TO:
Contents
This table shows what features are available if you’re running Entra ID (Azure AD) on PaperCut version 21.1 or earlier.
PaperCut 21.2 or higher has many extra features, including multi-factor authentication. For details, see Overview of synchronizing user and group details with Entra ID (Azure AD).
PaperCut version 21.1 or earlier using Microsoft Graph API.
| PaperCut Core | |
| Synchronize users and groups to PaperCut database 1 | Yes (PaperCut username is the MailNickName - user) |
| MFD/Copier swipe card authentication 1 | Yes |
| MFD/Copier swipe card self-association 2 | No |
| MFD/Copier username/password authentication | No |
| User or Admin User Web Interface username/password authentication | No |
| “Sign On with Microsoft” button (Azure SSO) on Admin or User Web Interface 3 | Yes |
| Mobile Web Client username/password authentication | No |
| PaperCut User Client username/password Authentication | No |
| “Sign On with Microsoft” button (Azure SSO) on the PaperCut user client 3 | No |
| Release Station swipe card authentication 1 | Yes |
| Release Station username/password authentication | No |
| Print Deploy | |
| Print Deploy User Client username/password authentication | No |
| Print Deploy Web Admin username/password authentication | No |
| “Sign On with Microsoft” button (Azure SSO) on Print Deploy client 3 | No |
| Mobility Print | |
| Mobility Print client username/password authentication | No |
| Mobility Print Web Admin username/password authentication | No |
| “Sign On with Microsoft” button (Azure SSO) on Mobility Print client 3 | No |
| Universal Print | |
| Universal Print Connector | Yes |
| Other differences | |
| Cost | Free |
| Username in PaperCut | UPN (e.g. alex.test@papercut.com) |
| Support 2FA / MFA through the PaperCut sync source | No |
| Ability to sync card numbers with Azure | Yes4 |
| Ability to sync user aliases with Azure | No5 |
| Ability to sync users that sit within nested groups 6 | No |
1 Swipe card authentication – use a swipe card with a card reader to log in to the device or release station. Since this only uses the card number (and optional PIN), username/password authentication is not involved.
2 Swipe card self-association – use a brand new swipe card with a card reader to log in to the device. Since PaperCut does not recognize the card number, it will ask the user to log in with their username and password, to ‘self-associate’ the new card with their user record.
3 ‘Single Sign on with Microsoft’ method of signing in – enabled on the Admin and User web interfaces under Options > User/Group Sync > Single Sign on with Microsoft > Enable the ‘Sign in with Microsoft’ button.
4 When using the standard Azure AD sync method, if you want to sync a primary card number, set the config key user-source.update-user-details-card-id to Y. On next sync, the Employee ID number from Entra ID is synced into the Primary Card Numberfield in PaperCut. There are no other configuration options available for this currently. Other alternatives for importing card numbers when using the standard Entra ID method are to use a batch-update method, auto-generation of card numbers, or an external lookup as detailed in User card and ID numbers .
5 An alternative option for the standard Entra ID method to update the user alias fields is to use the batch import and update user process - however that leads to an ongoing maintenance overhead.
6 If you want to sync a group of users (for example, Group B) that’s nested under another group (for example, Group A), when you configure the sync source settings be sure to explicitly target the nested group (Group B). If you target the higher-level group, no users will be synced. Always explicitly target sync sources.
Categories: How-to Articles
Keywords: Entra ID, Azure AD,
Last updated February 15, 2024
Comments