Helpdesk: "The new hires can't find any printers when they click Add a printer. Sam can see the second-floor printer but not the one by his desk. Everyone's jobs to Reception say 'Sending to printer' and never come out, and since last week's Windows update Dana's printer says it 'experienced an unexpected configuration problem.' Can you just re-register the printers?"
Don't re-register yet. "Universal Print not working" is usually one broken layer in a documented chain, not a broken service: the user has no eligible license (or the license has no Universal Print service plan) → the printer is registered but not shared, or the user isn't on the share's Access Control → the Windows device can't reach Universal Print as that user (not Entra joined or registered, extra work accounts, a leftover Hybrid Cloud Print key, a proxy only the browser knows about) → the Intune Printer Provisioning policy has the wrong IDs or targets an unsupported device → the job reached the cloud queue but the printer or connector never claimed it → the connector host itself is unhealthy (service, spooler, driver, network). The Universal Print portal's printer and share pages, the Jobs view, dsregcmd, the Intune policy status, and the connector's event log are the sources for that chain. Unsharing and re-registering a printer the wrong way can break every user's existing connection to it.
If the sign-in prompt during printer discovery shows AADSTS50020 (a personal or wrong-tenant account), start with AADSTS50020 User Account Does Not Exist in Tenant. If dsregcmd /status shows AzureAdPrt : NO on a joined device, fix that first with AzureAdPrt : NO in dsregcmd /status. This post covers "users can't find, install, or print to a Universal Print printer, and you need a read-first path before you unshare, unregister, or reinstall anything."
TL;DR
- License first. Microsoft: both end users and admins need an eligible Universal Print license, and the product must include the Universal Print service plan. Check the user's usage location too. Going over the monthly job volume doesn't stop printing. Microsoft says users can continue to print and the admin gets an overage alert.
- Registered isn't shared, and shared isn't allowed. A registered printer must be shared, and the user (or a group they're in) must be on the share's Access Control list, unless the share allows all users.
-
Read
dsregcmd /statuson the user's PC. Microsoft's check: AzureAdJoined : YES and AzureAdPrt : YES, or WorkplaceJoined : YES. Windows Server isn't a supported print client. - Windows shows only the first 10 printers Universal Print returns, picked by proximity. A printer with no location set, or a PC with location services off, may not appear until the user searches for it.
-
Read the Jobs view before the printer. No job in the portal means it failed on the user's device. Pending means it's waiting for the printer or connector to claim it. Aborted with status code
0x80004004(E_ABORT) means it expired after 3 days unclaimed. - Unsharing and re-sharing with the same name breaks users' connections. Microsoft: users then have to remove and re-add the printer. Swap the printer behind the share instead when you need to re-register.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Symptom captured | Which user, which PC, which printer, what Windows showed | "Universal Print is down" with no detail |
| 2. License and portal | Eligible license with the Universal Print service plan; admin role | No printers for anyone new; admin gets a 403 in the portal |
| 3. Printer and share | Printer registered, shared, user on Access Control, printer Ready and accepting jobs | One printer missing for some users; jobs rejected |
| 4. Windows client | Entra joined or registered, one work account, Universal Print endpoints reachable | No printers discovered at all; credential prompt; Offline |
| 5. Intune provisioning | Printer Provisioning policy with correct IDs, assigned to users, supported Windows | Printer never auto-installs; policy error in Intune |
| 6. Print jobs | Job in the Jobs view, claimed by the printer, Completed | "Sending to printer," Pending forever, Aborted |
| 7. Connector host | Services running, current connector version, printer prints locally, network open | Stopped, Offline, or every job on one connector failing |
| 8. Known issues | The ticket matches a documented Windows or driver issue | A specific error after an update or a driver change |
Step 1: Capture the exact symptom (read-only)
Write these facts on the ticket before anyone unshares or re-registers a printer:
| Fact | Why it matters |
|---|---|
| User, PC, and time | You need the user's license, the PC's join state, and the exact job in the Jobs view |
| Printer share name | Users see the share name, not the registered printer name |
| Install path | Added manually in Settings, or pushed by an Intune Printer Provisioning policy |
| What Windows showed | No printers found, one printer missing, a sign-in prompt, Offline, "Attention required," or an error code |
| Queue status on the PC | "Sending to printer," "Error - Sending to printer," or nothing in the queue |
| Connector or native | Universal Print ready printer, or a printer registered through a connector |
| What changed | New hire, new PC, Windows update, driver update, printer maintenance, a re-share |
| Pattern | Likely layer |
|---|---|
| No Universal Print printers discovered for one user | License, join state, or work accounts (Steps 2, 4) |
| Some printers discovered, one missing | Share Access Control, location, or the 10-printer list (Steps 3, 4) |
| Credential dialog during discovery, then AADSTS50020 | Wrong account (personal or other tenant) on the PC (Step 4) |
| Intune says the printer policy failed | Policy IDs, OS version, or share access (Step 5) |
| Job never appears in the portal Jobs view | Failed on the user's device: network, proxy, or join state (Steps 4, 6) |
| Job Pending or Processing in the portal, nothing prints | Printer or connector didn't claim or finish it (Steps 6, 7) |
| Printer "Stopped" in the portal after maintenance | Connector didn't notice the printer came back (Step 7) |
| Error 0x80004005 "unexpected configuration problem" on Windows 11 | Documented KB5083769 regression for printers installed on Windows 10 (Step 8) |
Step 2: License and portal access (read-only)
Microsoft's licensing page lists the eligible subscriptions (Microsoft 365 E3, E5, F3, and Business Premium; Windows 10/11 Enterprise E3 and E5; standalone Universal Print; plus Education and Government equivalents). Both end users and IT administrators need one.
The troubleshooting guide's check: in Entra ID → Licenses → All products, open the product, then Service plan details, and confirm Universal Print is in the list. Then confirm the user is assigned that product and has a usage location set.
# Read-only (Microsoft Graph PowerShell)
# Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -UserId 'sam@contoso.com' -Property UserPrincipalName, UsageLocation |
Select-Object UserPrincipalName, UsageLocation
# Service plans on the user's licenses; look for a plan whose name contains PRINT
Get-MgUserLicenseDetail -UserId 'sam@contoso.com' |
Select-Object -ExpandProperty ServicePlans |
Where-Object ServicePlanName -like '*PRINT*' |
Select-Object ServicePlanName, ProvisioningStatus
The *PRINT* match is a convenience filter, not a documented plan name. Confirm against the product's Service plan details in the portal.
Print volume is a separate question. Each eligible license adds jobs to one shared tenant pool that refreshes monthly, and a job counts only when it completes. If the pool runs out, users can continue to print. Microsoft sends an overage alert to the administrator of record. An overage is a purchasing conversation, not the cause of a "printing stopped" ticket.
Admin gets a 403 in the Universal Print portal? Microsoft's checks: the admin has the Global Administrator or Printer Administrator role, holds a Universal Print license, and the Universal Print enterprise application has Enabled for users to sign-in? set to Yes.
Step 3: Is the printer registered, shared, and allowed? (read-only)
Universal Print separates printers (the registered queue) from printer shares (what users discover, and who may use it). A printer can be registered and healthy and still invisible to users because it was never shared, or because the user isn't allowed.
In the Universal Print portal:
- Printer shares → the share → Overview: the Printer Share Name has a value, so the printer is shared.
- Printer shares → the share → Access Control: the user or one of their groups is listed (or the share allows all users).
- Printers → the printer → Overview: Status isn't Stopped, and Is accepting jobs isn't No. If the status isn't Ready, read Printer Status Reasons.
# Read-only: printers, their share, and state
# Connect-MgGraph -Scopes 'Printer.Read.All','PrinterShare.Read.All','PrintConnector.Read.All'
Get-MgPrintPrinter -All -ExpandProperty shares |
Select-Object DisplayName, IsShared, IsAcceptingJobs, LastSeenDateTime,
@{n='State';e={$_.Status.State}},
@{n='StatusDescription';e={$_.Status.Description}},
@{n='Share';e={($_.Shares | ForEach-Object DisplayName) -join ', '}}
# Who is allowed on one share (AllowAllUsers = $true supersedes the allow lists)
$share = Get-MgPrintShare -All | Where-Object DisplayName -eq 'Reception'
$share | Select-Object Id, DisplayName, AllowAllUsers
Get-MgPrintShareAllowedUser -PrinterShareId $share.Id -All | Select-Object Id, DisplayName, UserPrincipalName
Get-MgPrintShareAllowedGroup -PrinterShareId $share.Id -All | Select-Object Id, DisplayName
# Connectors: version and host (compare AppVersion with the latest installer in Step 7)
Get-MgPrintConnector -All |
Select-Object DisplayName, AppVersion, FullyQualifiedDomainName, OperatingSystem, RegisteredDateTime
How to read it:
| What you see | What it means |
|---|---|
IsShared False |
Registered, never shared. Users can't discover it |
AllowAllUsers False and the user isn't in either allow list |
Access Control is the finding |
State stopped |
The printer reported an issue (for example, out of paper). Read the description first |
IsAcceptingJobs False |
Users may not be able to send jobs to it |
LastSeenDateTime old |
A hint, not proof. Microsoft documents that Last Seen can be wrong for connector printers and for printers that only report during jobs |
The UniversalPrintManagement module has equivalents (Connect-UPService, then Get-UPPrinter, Get-UPPrinterShare, Get-UPAllowedMember, Get-UPConnector, Get-UPPrintJob) if your team already uses it.
Step 4: The Windows client (read-only on the PC)
Microsoft's prerequisites: printing from Windows needs version 1903 or later, and Windows Server isn't supported as a print client. The PC must reach the Universal Print endpoints (print, register, discovery, notification, and graph under print.microsoft.com, plus login.microsoftonline.com in commercial clouds).
Read these on the user's PC, signed in as the user:
# Read-only: join and PRT state (Microsoft's documented check for Universal Print)
dsregcmd /status | Select-String 'AzureAdJoined','AzureAdPrt','WorkplaceJoined'
# Read-only: the WinHTTP proxy (Universal Print can't use WPAD settings that only the browser sees)
netsh winhttp show proxy
# Read-only: is there a leftover Hybrid Cloud Print policy key? (path contains a per-user SID)
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current' -ErrorAction SilentlyContinue |
Where-Object { Test-Path (Join-Path $_.PSPath 'EnterpriseCloudPrint') } |
Select-Object PSChildName
| Finding | What Microsoft documents |
|---|---|
| Neither AzureAdJoined : YES with AzureAdPrt : YES, nor WorkplaceJoined : YES | The PC isn't connected to Entra ID the way Universal Print needs. Fix the join or PRT first |
| More than one work or school account in Settings → Accounts → Access work or school | On an Entra joined PC, remove the additional accounts. On a non-joined PC, keep only the account for the tenant that has the printer |
An EnterpriseCloudPrint key under PolicyManager |
The user is still in a Hybrid Cloud Print deployment. If a policy set it, it comes back on the next policy apply, so remove it from the policy, not just the registry |
| No WinHTTP proxy where one is required |
*.print.microsoft.com may be blocked. Microsoft notes WPAD is used only by the browser |
Credential dialog during discovery, then AADSTS50020 from live.com
|
The user typed a personal or other-tenant account. Use the account from the tenant that runs Universal Print |
One printer missing, others found? Microsoft: Windows shows only the first 10 printers Universal Print returns, chosen by proximity to the user. If the printer has no location properties, or Windows location services are off, it may not show up automatically. Have the user choose Search Universal Print for printers (or Search by location or keywords, depending on the Windows version) and search by name or browse the building hierarchy.
Printer shows Offline on the PC? Microsoft's first check is on the connector side: print a test page from the connector host, then run the connector checklist (Step 7).
Step 5: Intune Printer Provisioning (read-only)
Intune installs Universal Print printers through a Settings catalog policy (Printer Provisioning) that uses the UniversalPrint CSP. The CSP calls UPPrinterInstaller.exe to add the printer for the user. Microsoft's layering for "the printer didn't appear": was the policy assigned, did the device sync, did the CSP receive the settings, or did the installer fail?
Read the policy and its per-device status:
| Check | What Microsoft documents |
|---|---|
| Cloud Device ID | The printer ID from the Universal Print portal |
| Printer Shared ID and Printer Shared Name | From the share in the portal. Microsoft notes the Printer ID and Shared ID are sometimes reversed, which stops discovery |
| Assignment | Assigned to users. They need a Universal Print license and access to the printer. If the assigned group lacks share permissions, Intune grants them |
| Windows version | Windows 11, or Windows 10 with the July 2022 update (KB5015807) or later. Error 0x8007007f (ERROR_PROC_NOT_FOUND) usually means an unsupported OS version |
| Manual discovery | Microsoft: if the user can't discover or install the printer manually, the Intune policy fails too. Fix Steps 3–4 first |
| Printer removed, unshared, or permissions removed | The policy then fails to install the printer |
| Shared (multi-user) PCs | Not officially supported outside Azure Virtual Desktop. Password-only sessions can fail silently when Conditional Access requires MFA |
| Removing printers | Microsoft notes an Intune "uninstall" option is still planned. For now users remove printers manually |
The CSP reports a per-printer Status (1 = completed, 2 = in progress, 4 = failed, 8 = initial) and the last install ErrorCode (an HRESULT). Intune's per-device profile status is the admin view of the same result. On the device, the Application event log can show Universal Print errors:
# Read-only, on the user's PC: recent Application events from Universal Print components
Get-WinEvent -LogName Application -MaxEvents 2000 |
Where-Object { $_.ProviderName -like '*Universal Print*' -or $_.ProviderName -like '*UPPrinterInstaller*' } |
Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message -First 30
The provider-name match is a wildcard on purpose. Microsoft's pages refer to a "Universal Print" event source and a UPPrinterInstaller.exe entry. For deeper client-side traces, Microsoft documents running TSS with the UEX_PrintFull scenario while re-running UPPrinterInstaller.exe.
Step 6: Read the Jobs view (read-only)
Open Printers → the printer → Jobs in the Universal Print portal and find the user's job.
| What you see | What Microsoft says it means |
|---|---|
| No job (printed within the last 10 days) | It most likely failed on the user's device. Back to Step 4 (network, proxy, join), then a network trace |
| Pending | Uploaded to Universal Print and waiting for the printer to acknowledge it |
| Paused | Waiting for an external process or user action, such as secure release |
| Processing | The printer (or connector) acknowledged the job and started processing it |
| Stopped | A printer issue has to be addressed before the job can continue |
| Aborted | Printing failed, or the job expired: not finished within 3 days of creation |
| Completed | Printed. If paper didn't come out, it's the device or release solution, not the cloud queue |
Pick the right job before you dig. Microsoft's debugging guide: if the user's job is Aborted, read its Status Code. If it's Pending, look for the job that is still Processing on that printer, because one stuck job holds up the ones behind it. With secure release, a job can wait until the user releases it at the printer while other jobs stay Pending. Empty Printer acknowledged, Download, and Final times mean the printer or connector never picked it up.
# Read-only: one user's recent jobs on one printer
# Connect-MgGraph -Scopes 'Printer.Read.All','PrintJob.ReadBasic.All'
$printer = Get-MgPrintPrinter -All | Where-Object DisplayName -eq 'Reception-01'
Get-MgPrintPrinterJob -PrinterId $printer.Id -Filter "createdBy/userPrincipalName eq 'sam@contoso.com'" -Top 20 |
Select-Object Id, CreatedDateTime, AcknowledgedDateTime, ErrorCode,
@{n='State';e={$_.Status.State}},
@{n='Acquired';e={$_.Status.IsAcquiredByPrinter}},
@{n='Description';e={$_.Status.Description}}
A few documented status codes worth recognizing:
| Status code | Microsoft's description | Where to look |
|---|---|---|
0x80004004 (E_ABORT) |
Queued successfully but expired after 3 days | Is the printer online and connected? Then the connector host (Step 7) |
0x80131509 |
Failed because of permissions on the printer queue on the connector (for example, Everyone removed) | Queue Security tab on the connector host |
0x80040106 |
Driver taking too long, or a driver setting that waits for input (job password, accounting code) | Driver settings on the connector host |
0x80040104 |
The job failed in the Windows print spooler on the connector host | Spooler on the connector host |
0x80040003 |
Print ticket not supported or has invalid elements | Consider a different driver on the connector host |
0x80004005 (E_FAIL) |
Generic. One documented cause is a Brother driver issue | Step 8 |
A status code of zero on an Aborted job usually means it was sent long ago and expired. Ask the user to print again.
Step 7: The connector host (read-only)
If the printer is registered through the Universal Print connector, the connector host is part of the print path. Find it in the portal (Printers → the printer → Connectors, Hostname), then sign in to that machine.
Microsoft's connector checklist:
-
Services running: Print Connector service (
PrintConnectorSvc.exe) and the Spooler. - Current version: the first three parts of the version in the latest installer's file name match the connector app's title bar.
-
Network: the host reaches the Universal Print endpoints. The connector runs as a service, so user-level auto-proxy settings don't apply. Microsoft says to set the proxy for the LocalSystem account (with
bitsadmin). - The printer itself: print a test page from the connector host. If that fails, it isn't a cloud problem.
- Always on: the host runs 24x7 with sleep and hibernate off. Microsoft warns not to clone a connector machine and run both copies, because the connectors interfere with each other and block printing.
# Read-only, on the connector host
Get-Service -Name Spooler
Get-Service -DisplayName 'Print Connector*'
# Connector channel (same log as: eventvwr /c:Microsoft-Windows-PrintConnector/Operational)
Get-WinEvent -LogName 'Microsoft-Windows-PrintConnector/Operational' -MaxEvents 300 |
Where-Object { $_.Id -in 8, 9, 27 -or $_.LevelDisplayName -eq 'Error' } |
Select-Object TimeCreated, Id, LevelDisplayName, Message -First 40
| Event or message | What Microsoft documents |
|---|---|
| Event 8 | Printer Registration Failure, with the reason |
| Event 9 | Merge Ticket failure: the connector driver's options don't match the supported IPP options. Also logged as "PrintJob failed" after an Event 27 impersonation failure |
| Event 27 | Hybrid AD impersonation failed. With Enable hybrid AD configuration on and the prerequisites not met, Microsoft's fix is to turn it off |
| "Skipping printer" | Why a printer wasn't offered for registration. Only printers installed locally on the connector PC are listed, not Point and Print or print-server shares |
| "Unable to connect to the remote server" | The connector can't reach Azure to send printer status |
| XPS_JOB_FAILED | A job failure. Match "UP Job Id" to the job Id in the portal |
| "has been deregistered from cloud" / DeregisteredDeviceException | The printer was deleted from Entra ID Devices. It's unregistered on the connector but still shows Registered in the portal |
| App says the WCF endpoint isn't listening, or the service crashes on start | Port 8091 conflict. Check with netstat -a
|
Printer back from maintenance but still Stopped in the portal (and "Attention required" on PCs)? Microsoft's documented fix is small: on the connector host, open the printer's queue, toggle Pause Printing on and then off, and the connector reports it online again.
Jobs show the user as System? Microsoft says that's expected with the connector, which runs as Local System. Hybrid AD configuration changes that only where its prerequisites are met.
Step 8: Documented issues that look like "Universal Print is broken" (read-only)
| Issue | What Microsoft documents | What to do |
|---|---|---|
| Windows 11 KB5083769 or later, printer installed back on Windows 10 | Print dialog shows "Your printer has experienced an unexpected configuration problem. 0x80004005" and Print is disabled. A test page may show 0x000003e3
|
Detect with reg query "HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers". An affected printer's key is just the printer name, with no S-1-12-1-...: prefix. Fix: remove and re-add the printer, or use Microsoft's Convert-UpPrinterToPerUser.ps1 in bulk |
| Printer unshared, then re-shared with the same name | Users' connections break | Users uninstall and re-install the printer |
| Connector printer swapped to a Universal Print ready printer | Printing can fail, and the failed job doesn't appear in the Jobs list | 22H2+: restart Windows (or end PrintDialog.exe). Older versions: remove and re-add |
| Brother printer newly registered through the connector | All jobs Aborted, Event 9 print-ticket validation error | Microsoft's documented GenerateCustomPrintTicketMappings.ps1 workaround on the connector host |
| Xerox or Kyocera app installed after adding a connector printer | A Print Support App installed for a connector printer stops it working | Uninstall the app. Tell users not to click "App available for this device" |
| Printer options or defaults not updated on the PC after a portal change | Windows doesn't refresh capabilities automatically (fixed in Windows 11) | Remove and re-add the printer on the PC |
The KB5083769 entry also changes behavior afterward: Microsoft notes that after the mitigation, Universal Print printers are installed per user only.
Step 9: Change one thing (only after the read)
After Steps 1–8 agree on the layer:
- License: assign the eligible product to the user (and set the usage location) rather than adding licenses tenant-wide.
- Access Control: add the user's group to the one share they need. Don't flip the share to all users to close one ticket.
- Client: fix the one documented thing (the extra work account, the Hybrid Cloud Print policy, the WinHTTP proxy, the join or PRT).
- Intune: correct the swapped Printer ID / Shared ID, or fix the assignment, then sync and re-read the device status.
- Stopped after maintenance: pause and resume the queue on the connector host.
- Connector: update the connector, fix the one service, proxy, or driver finding, and retest with a test page from the host first.
- Re-register only when the evidence says so (for example, a printer deleted from Entra Devices). To keep users' connections, use Microsoft's documented path: register a temporary printer, Swap printer on the share, unregister and re-register the real printer, then swap back.
Retest with one fresh job, then read that job's state in the Jobs view before you close the ticket.
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| User has no license with the Universal Print service plan | Assign the eligible product | Assigning standalone licenses to everyone mid-incident |
| User not on the share's Access Control | Add their group to that share | Setting every share to all users |
| Extra work account / leftover Hybrid Cloud Print key | Remove the account; remove the policy that sets the key | Re-registering the printer |
| Printer missing from the list of 10 | Search Universal Print by name; set printer location | Sharing a duplicate printer under a new name |
| Intune policy fails; IDs reversed | Swap the IDs in the policy | Deleting and recreating the share |
| Job Pending behind one Processing job | Investigate that one job and the connector host | Cancelling every job on every printer |
| Printer Stopped after maintenance | Pause/resume the queue on the connector host | Unregistering the printer |
| Printer deleted from Entra Devices | Swap-and-re-register so the share endpoint survives | Unshare and re-share with the same name |
| KB5083769 symptom | Remove/re-add, or Microsoft's conversion script | Uninstalling the Windows update without reading the known issue |
| Two connector clones running | Turn off or clean up the clone as documented | Re-registering printers on both |
FAQ
Why can't users find any Universal Print printers?
Microsoft's checks, in order: the PC is connected to Entra ID (dsregcmd /status shows AzureAdJoined and AzureAdPrt YES, or WorkplaceJoined YES), the user has a license with the Universal Print service plan, there's only one work account on the PC, no Hybrid Cloud Print key is left behind, the user is on a share's Access Control, and the PC can reach *.print.microsoft.com through WinHTTP.
Why can users see some printers but not the one they need?
Windows shows only the first 10 printers Universal Print returns, chosen by proximity. Without printer location properties, or with Windows location services off, a printer may not appear. Check the share's Access Control, then have the user use Search Universal Print for printers.
Why are Universal Print jobs stuck on Pending?
Pending means the job is in the cloud queue and the printer or connector hasn't acknowledged it. Look for a Processing job ahead of it on the same printer, check that the printer isn't Stopped, then work through the connector checklist. Jobs not finished within 3 days are Aborted with status code 0x80004004.
Does going over the Universal Print job limit stop printing?
No. Microsoft says users can continue to print when the tenant goes over its monthly volume, and the administrator of record gets an overage alert. Additional licenses or add-ons are a compliance purchase, not a fix for a printing outage.
Why does the Intune Universal Print policy fail?
The most common documented causes: Printer ID and Shared ID entered in reverse, the printer removed or unshared, missing permissions, or an unsupported Windows version (error 0x8007007f). If the user can't discover and install the printer manually, the policy fails too.
Related posts
- AzureAdPrt : NO in dsregcmd /status (Universal Print discovery needs a joined device with a PRT, or a workplace-joined account)
- AADSTS50020 User Account Does Not Exist in Tenant (the credential prompt during printer discovery with a personal or wrong-tenant account)
- Company Portal can't connect / device not syncing (no check-in means no Printer Provisioning policy)
Free checklist
Universal Print signs users in with their Entra token, so a new "require MFA" or compliant-device Conditional Access policy can turn into printer tickets. Microsoft documents that on shared PCs with password-only sessions, Intune printer installs fail silently when CA requires MFA. Before you enforce, the free Conditional Access pre-enforcement checklist keeps break-glass accounts, pilot groups, and report-only review on one page:
If you want the rest of the Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=universal-print-not-working
Admin Pack Studio; not affiliated with Microsoft. Steps 1–8 favor read-only checks: the Universal Print portal's printer, share, Access Control, and Jobs pages, Get-MgUserLicenseDetail, Get-MgPrintPrinter, Get-MgPrintShare, Get-MgPrintShareAllowedUser/Group, Get-MgPrintPrinterJob, dsregcmd /status, netsh winhttp show proxy, the Intune policy status, and the connector's event log. Assigning licenses, changing share Access Control, editing Intune policies, removing work accounts or policy keys, pausing queues, swapping, unregistering, or re-registering printers, and running Microsoft's conversion script are deliberate changes. Change one layer at a time, retest with one job, and check current Microsoft Learn for portal labels and supported versions.
Top comments (0)